Function at 0x1006e0a
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x1014d9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x103
mov ebx, 0x1015160
push ebx
push dword [0x10154f8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1006e46
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1007332
push edi
xor edi, edi
mov word [0x1015366], di
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0xc0], 0x1001638
mov dword [ebp - 0xb4], edi
push esi
mov eax, dword [ebp - 0xc0]
push dword [eax]
mov esi, 0x1013020
push 0x1001948
push 0x28
push 0x10154a8
call fcn.01006339
add esp, 0x10
cmp eax, edi
jl 0x1007330
mov ecx, dword [ebp - 0xb4]
mov ecx, dword [ecx + 0x1013144]
cmp ecx, edi
je 0x1006ead
push ecx
push 0x28
push 0x10150c0
call fcn.010061c4
cmp eax, edi
jl 0x1007330
mov eax, dword [ebp - 0xb4]
push dword [eax + 0x1013148]
push 0x64
push 0x1015368
call fcn.010061c4
cmp eax, edi
jl 0x1007330
cmp dword [0x1013020], edi
je 0x1006fb6
lea ecx, [esi + 4]
cmp dword [ecx], edi
je 0x1006fae
cmp dword [esi + 8], edi
je 0x1006fae
mov eax, dword [esi]
mov esi, ecx
mov ecx, dword [esi]
push ecx
push eax
lea eax, [ebp - 0xa4]
push 0x50
push eax
add esi, 4
call fcn.01006339
add esp, 0x10
cmp eax, edi
jl 0x1007330
push edi
lea eax, [ebp - 0xc8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
lea eax, [ebp - 0xa4]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1006f63
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esi]
push 1
push edi
push edi
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1006f69
inc dword [ebp - 0xa8]
add esi, 4
mov eax, dword [esi]
cmp eax, edi
je 0x1006f9f
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esi + 4]
push 1
push edi
push dword [esi]
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1006f9f
inc dword [ebp - 0xa8]
push dword [ebp - 0xc8]
add esi, 8
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi], edi
jne 0x1006ee1
cmp dword [0x1015508], edi
je 0x1007217
push edi
push 1
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xb0]
push eax
mov dword [ebp - 0xb0], edi
call fcn.01006c37
add esp, 0x10
test eax, eax
jne 0x10071ca
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0xbc], edi
mov dword [ebp - 0xac], 0x2001f
mov dword [ebp - 0xcc], edi
xor esi, esi
call fcn.01005874
movzx eax, al
cmp eax, edi
mov dword [ebp - 0xc4], eax
je 0x1007023
mov dword [ebp - 0xac], 0x2011f
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xe4], 0xc
mov dword [ebp - 0xdc], edi
mov dword [ebp - 0xe0], eax
push esi
push 1
lea ecx, [ebp - 0xd0]
call fcn.010063d6
cmp esi, edi
je 0x100705b
mov dword [ebp - 0xcc], 1
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xe4]
push eax
push dword [ebp - 0xac]
push edi
push edi
push edi
push 0x10018e0
push 0x80000002
call esi
cmp eax, edi
mov dword [ebp - 0xb0], eax
jne 0x10070d2
cmp dword [ebp - 0xc4], edi
je 0x10070c0
push edi
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xe4]
push eax
push 0x2001f
push edi
push edi
push edi
push 0x10018e0
push 0x80000002
call esi
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], edi
jne 0x10070d2
mov dword [ebp - 0xcc], 1
cmp dword [ebp - 0xd0], 2
je 0x10070e7
push dword [ebp - 0xd0]
call fcn.01004a8f
pop ecx
xor esi, esi
inc esi
cmp dword [ebp - 0xcc], edi
je 0x100703f
cmp dword [ebp - 0xb0], edi
jne 0x10071ca
push 0x5c
push ebx
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x1007171
cmp esi, ebx
je 0x1007171
push ebx
mov word [esi], di
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp dword [ebp - 0xc4], edi
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push edi
push 0x10018b8
jne 0x1007154
push dword [ebp - 0xb8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100714d
inc dword [ebp - 0xa8]
mov word [esi], 0x5c
jmp 0x10071aa
push dword [ebp - 0xbc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100716a
inc dword [ebp - 0xa8]
mov word [esi], 0x5c
jmp 0x1007177
inc dword [ebp - 0xa8]
cmp dword [ebp - 0xc4], edi
je 0x10071aa
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push edi
push 0x10018a0
push dword [ebp - 0xb8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10071aa
inc dword [ebp - 0xa8]
push dword [ebp - 0xb8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
cmp dword [ebp - 0xbc], edi
je 0x10071d0
push dword [ebp - 0xbc]
call esi
jmp 0x10071d0
inc dword [ebp - 0xa8]
call fcn.01005915
test al, al
je 0x10071ef
push 0x1013074
call fcn.01006c9c
neg al
pop ecx
sbb eax, eax
inc eax
add dword [ebp - 0xa8], eax
call fcn.01005915
test al, al
jne 0x1007201
call fcn.01005874
test al, al
je 0x1007217
push 0x1013130
call fcn.01006c9c
neg al
pop ecx
sbb eax, eax
inc eax
add dword [ebp - 0xa8], eax
xor esi, esi
lea eax, [ebp - 0xac]
inc esi
push eax
mov dword [ebp - 0xac], esi
call fcn.01004818
pop ecx
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0xac]
push edi
push 0x1001884
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10072fc
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xd8]
push eax
push edi
push edi
push 0x1001858
push dword [ebp - 0xd4]
mov dword [ebp - 0xac], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10072f0
cmp dword [ebp - 0xd8], esi
jne 0x10072f0
push 0x44
pop esi
push esi
lea eax, [ebp - 0x138]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x138]
push eax
push edi
push edi
push 0x8000000
push edi
push edi
push edi
push edi
push 0x100183c
mov dword [ebp - 0x138], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10072f0
push 0xffffffffffffffff
push dword [ebp - 0xf4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xf4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xf0]
call esi
push dword [ebp - 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add dword [ebp - 0xc0], 0x10
add dword [ebp - 0xb4], 4
cmp dword [ebp - 0xc0], 0x1001648
jl 0x1006e67
cmp dword [ebp - 0xa8], edi
je 0x1007329
mov eax, 0x80040201
jmp 0x1007330
call fcn.0100573b
xor eax, eax
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.010108f5
leave
ret