Function at 0x10064b6
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x1014d9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x258], eax
mov eax, dword [ebp + 0xc]
push 4
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x254]
pop ecx
xor ebx, ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
add eax, 8
dec ecx
jns 0x1006433
mov eax, dword [ebp + 0x10]
xor esi, esi
xor edi, edi
cmp eax, 7
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x12], bl
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], 1
mov dword [ebp - 0x228], ebx
ja case.default.0x100647a
jmp dword [eax*4 + 0x1006bc6]
lea ecx, [ebp - 0x254]
call fcn.01004e2b
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0xc]
push eax
call esi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x24c]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x14]
push eax
call esi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x244]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push reloc.ADVAPI32.dll_SetSecurityDescriptorDacl
push 2
lea eax, [ebp - 0xc]
push eax
call esi
test eax, eax
je 0x1006595
mov eax, dword [ebp + 0x14]
neg eax
sbb eax, eax
and eax, 0xfe10001
add eax, 0x1effff
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x248], 0xa0120000
jmp 0x100695e
lea ecx, [ebp - 0x254]
call fcn.01004e2b
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0xc]
push eax
call esi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x24c]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push reloc.ADVAPI32.dll_SetSecurityDescriptorDacl
push 2
lea eax, [ebp - 0xc]
push eax
call esi
test eax, eax
je 0x1006595
mov eax, dword [ebp + 0x14]
neg eax
sbb eax, eax
and eax, 0xfe10001
add eax, 0x1effff
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x248], eax
mov edi, dword [ebp - 0x24c]
push 2
jmp 0x100696c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1006b9d
lea ecx, [ebp - 0x254]
call fcn.01004e2b
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x14]
push eax
call esi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x24c]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0xc]
push eax
call esi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x244]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push reloc.ADVAPI32.dll_SetSecurityDescriptorDacl
push 2
lea eax, [ebp - 0xc]
push eax
call esi
test eax, eax
je 0x1006595
cmp dword [ebp + 0x14], ebx
mov edi, dword [ebp - 0x244]
mov dword [ebp - 0x250], 0x13ffff
jne 0x100662d
mov dword [ebp - 0x250], 0x12ffff
mov eax, 0x10000000
mov dword [ebp - 0x248], eax
jmp 0x1006964
lea ecx, [ebp - 0x254]
call fcn.01004e2b
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 4
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0xc]
push eax
call edi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x24c]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push esi
lea eax, [ebp - 0xc]
push eax
call edi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x244]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push reloc.ADVAPI32.dll_SetSecurityDescriptorDacl
push 2
lea eax, [ebp - 0xc]
push eax
call edi
test eax, eax
je 0x1006595
mov edi, dword [ebp - 0x244]
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x248], esi
mov dword [ebp - 0x240], esi
jmp 0x100696a
lea ecx, [ebp - 0x254]
call fcn.01004e2b
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 4
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0xc]
push eax
call edi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x24c]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push esi
lea eax, [ebp - 0xc]
push eax
call edi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x244]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push reloc.ADVAPI32.dll_SetSecurityDescriptorDacl
push 2
lea eax, [ebp - 0xc]
push eax
call edi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x23c]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x13
push esi
lea eax, [ebp - 0xc]
push eax
call edi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x234]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x14
push esi
lea eax, [ebp - 0xc]
push eax
call edi
test eax, eax
je 0x1006595
mov edi, dword [ebp - 0x244]
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x248], esi
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x230], esi
push 5
jmp 0x100696c
lea ecx, [ebp - 0x254]
call fcn.01004e2b
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0xc]
push eax
call edi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x24c]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push reloc.ADVAPI32.dll_SetSecurityDescriptorDacl
push 2
lea eax, [ebp - 0xc]
push eax
call edi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x244]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 4
push esi
lea eax, [ebp - 0xc]
push eax
call edi
test eax, eax
je 0x1006595
mov eax, dword [ebp - 0x254]
mov edi, dword [ebp - 0x24c]
mov dword [ebp - 0x228], eax
jmp 0x10066c3
lea ecx, [ebp - 0x254]
call fcn.01004e2b
mov edi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0xc]
push eax
call edi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x24c]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push reloc.ADVAPI32.dll_SetSecurityDescriptorDacl
push 2
lea eax, [ebp - 0xc]
push eax
call edi
test eax, eax
je 0x1006595
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x248], esi
jmp 0x1006588
lea ecx, [ebp - 0x254]
call fcn.01004e2b
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea eax, [ebp - 0x14]
push eax
call esi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x24c]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0xc]
push eax
call esi
test eax, eax
je 0x1006595
lea ecx, [ebp - 0x244]
call fcn.01004e2b
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push reloc.ADVAPI32.dll_SetSecurityDescriptorDacl
push 2
lea eax, [ebp - 0xc]
push eax
call esi
test eax, eax
je 0x1006595
mov eax, 0x10000000
mov dword [ebp - 0x250], 0x2001b
mov dword [ebp - 0x248], eax
mov edi, dword [ebp - 0x244]
mov dword [ebp - 0x240], eax
push 3
pop esi
cmp esi, ebx
mov dword [ebp - 0x22c], 8
mov dword [ebp - 0x224], ebx
jle 0x10069b2
mov eax, dword [ebp - 0x224]
push dword [ebp + eax*8 - 0x254]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [ebp - 0x22c]
inc dword [ebp - 0x224]
cmp dword [ebp - 0x224], esi
lea eax, [ecx + eax + 8]
mov dword [ebp - 0x22c], eax
jl 0x1006981
lea ecx, [ebp - 0x220]
call fcn.01005d7b
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x21c], eax
jge 0x10069d7
push eax
lea ecx, [ebp - 0x220]
call fcn.01005df4
cmp dword [ebp - 0x220], ebx
jne 0x10069fa
cmp dword [ebp - 0x21c], 0x200
jle 0x10069f2
push ebx
call fcn.01005859
pop ecx
push 0xe
pop esi
jmp 0x1006b9d
push 2
push dword [ebp - 0x22c]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x1006b7d
cmp esi, ebx
mov dword [ebp - 0x224], ebx
jle 0x1006a86
mov eax, dword [ebp - 0x224]
shl eax, 3
push dword [ebp + eax - 0x254]
push dword [ebp + eax - 0x250]
push 2
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x1006b7d
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x224]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x1006b7d
inc dword [ebp - 0x224]
cmp dword [ebp - 0x224], esi
mov eax, dword [ebp - 0x22c]
mov byte [eax + 1], 3
jl 0x1006a20
push 1
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x1006b7d
push ebx
push dword [ebp - 0x220]
lea eax, [ebp - 0x270]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x1006b7d
push ebx
push edi
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
test eax, eax
je 0x1006b7d
cmp dword [ebp - 0x228], ebx
je 0x1006af6
push ebx
push dword [ebp - 0x228]
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorGroup]
test eax, eax
je 0x1006b7d
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
mov ecx, dword [ebp - 0x25c]
cmp dword [ecx], eax
jae 0x1006b2c
cmp dword [ebp - 0x21c], 0x200
jle 0x1006b25
push dword [ebp - 0x220]
call fcn.01005859
pop ecx
push 0x7a
jmp 0x10069f4
push ecx
push dword [ebp - 0x258]
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.ADVAPI32.dll_MakeSelfRelativeSD]
test eax, eax
jne 0x1006b4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp dword [ebp - 0x21c], 0x200
jle 0x1006b64
push dword [ebp - 0x220]
call fcn.01005859
pop ecx
push 0x1004e46
push 5
push 8
lea eax, [ebp - 0x254]
push eax
call fcn.01004e50
mov eax, ebx
jmp 0x1006bb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x21c], 0x200
mov esi, eax
jle 0x1006b9d
push dword [ebp - 0x220]
call fcn.01005859
pop ecx
push 0x1004e46
push 5
push 8
lea eax, [ebp - 0x254]
push eax
call fcn.01004e50
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010108f5
leave
ret