Function at 0xf01a4cf
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Query or enumerate registry value
Set console window title
Set current directory
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58c
mov eax, dword [0xf061038]
push ebx
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x4e0]
push eax
xor esi, esi
inc esi
push esi
xor ebx, ebx
push ebx
push 0xf002354
push 0x80000002
mov dword [ebp - 0x4e8], 0x3a3f3d
mov dword [ebp - 0x4ec], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf01a568
lea eax, [ebp - 0x4ec]
push eax
lea eax, [ebp - 0x4dc]
push eax
push ebx
push ebx
push 0xf002348
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf01a55c
lea eax, [ebp - 0x4dc]
push 0xf002340
push eax
call fcn.0f0566a0
test eax, eax
pop ecx
pop ecx
je 0xf01a55c
mov dword [0xf06c750], esi
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0xf06bb04], ebx
push edi
mov byte [ebp - 0x1cc], bl
mov edi, 0x104
jne 0xf01a5d6
cmp dword [0xf06bb10], ebx
jne 0xf01a59c
push edi
lea eax, [ebp - 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
test eax, eax
jne 0xf01a59c
mov byte [ebp - 0x1cc], bl
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x44]
push 0xf00232c
push eax
call fcn.0f01336d
add esp, 0x14
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
jmp 0xf01a5ff
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
push dword [eax + 0x10]
lea eax, [ebp - 0x1cc]
push dword [0xf06bb14]
push 0xf002308
push eax
call fcn.0f01336d
add esp, 0x10
mov esi, dword [sym.ntvdm.exe_fSeparateWow]
cmp esi, ebx
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x568], eax
mov eax, dword [0xf06bb04]
mov word [ebp - 0x4f8], di
mov dword [ebp - 0x55c], ebx
mov dword [ebp - 0x560], ebx
je 0xf01a638
mov word [ebp - 0x4f4], 0x900
jmp 0xf01a64d
xor ecx, ecx
cmp eax, ebx
sete cl
lea ecx, [ecx + ecx + 0x102]
mov word [ebp - 0x4f4], cx
cmp eax, ebx
mov dword [ebp - 0x570], ebx
mov word [ebp - 0x4fc], bx
mov dword [ebp - 0x56c], ebx
mov word [ebp - 0x4fa], bx
je 0xf01a675
cmp esi, ebx
mov ecx, dword [0xf06bb14]
je 0xf01a67b
mov ecx, dword [0xf06bb10]
mov dword [ebp - 0x58c], ecx
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffffff7f
add ecx, 0x81
neg eax
sbb eax, eax
mov dword [ebp - 0x500], ecx
not eax
lea ecx, [ebp - 0xc8]
and eax, ecx
cmp byte [ebp - 0x1cc], bl
mov dword [ebp - 0x504], eax
lea eax, [ebp - 0x3dc]
mov dword [ebp - 0x514], ebx
mov dword [ebp - 0x510], ebx
mov word [ebp - 0x4f6], 0x105
mov dword [ebp - 0x564], eax
jne 0xf01a6ea
lea eax, [ebp - 0x1cc]
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0x508], edi
jmp 0xf01a6f6
mov dword [ebp - 0x50c], ebx
mov dword [ebp - 0x508], ebx
lea eax, [ebp - 0x58c]
push eax
mov byte [ebp - 0x2d4], bl
mov byte [0xf09b589], bl
mov byte [0xf09b58a], bl
mov byte [0xf09b58b], bl
call sub.KERNEL32.dll_GetNextVDMCommand
test eax, eax
je 0xf01a7e2
cmp dword [0xf06bb04], ebx
mov eax, dword [ebp - 0x500]
mov byte [ebp + eax - 0xc8], bl
jne 0xf01a7ac
cmp eax, ebx
je 0xf01a7ac
lea eax, [ebp - 0xc8]
push 0xf002300
push eax
call fcn.0f0566a0
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0xf01a7ac
add esi, 6
cmp byte [esi], 0x30
mov eax, esi
jl 0xf01a7ac
cmp byte [esi], 0x39
jg 0xf01a769
inc esi
cmp byte [esi], 0x30
jge 0xf01a75e
cmp eax, esi
je 0xf01a7ac
mov cl, byte [esi]
push 0xa
push ebx
push eax
mov byte [ebp - 0x4e1], cl
mov byte [esi], bl
call fcn.0f056645
mov cl, byte [ebp - 0x4e1]
add esp, 0xc
test al, 1
mov byte [esi], cl
je 0xf01a796
mov byte [0xf09b58a], 1
test al, 2
je 0xf01a7a1
mov byte [0xf09b58b], 1
test al, 4
je 0xf01a7ac
mov byte [0xf09b589], 1
cmp word [ebp - 0x4f6], bx
je 0xf01a7e2
mov al, byte [ebp - 0x3dc]
mov byte [ebp - 0x4e7], al
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0x4e8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x3dc]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [ebp - 0x2d4], bl
mov byte [0xf09b58c], bl
setne al
cmp dword [0xf06bb04], ebx
mov byte [0xf09b58d], bl
mov byte [0xf09b588], al
je 0xf01a826
mov dword [0xf06bb10], ebx
mov byte [0xf09b58a], 1
mov byte [0xf09b589], 1
mov byte [0xf09b58c], 1
mov byte [0xf09b58b], 1
lea eax, [ebp - 0x2d4]
push eax
call fcn.0f01156c
call fcn.0f00ecf6
mov edx, dword [0xf06bb04]
cmp edx, ebx
mov esi, 0x8000
je 0xf01a858
mov dword [0xf09b55c], ebx
mov dword [0xf0773e8], 0x3c00
jmp 0xf01a8a6
mov ax, word [0xf06c744]
cmp ax, 0xffff
mov ecx, 0x1000
je 0xf01a86c
movzx ecx, ax
mov ax, word [0xf06c740]
cmp ax, 0xffff
mov dword [0xf09b55c], ecx
jne 0xf01a885
mov eax, 0x3c00
jmp 0xf01a888
movzx eax, ax
cmp ecx, esi
mov dword [0xf0773e8], eax
jbe 0xf01a897
mov dword [0xf09b55c], esi
mov ecx, 0x400
cmp eax, ecx
jae 0xf01a8aa
mov dword [0xf0773e8], ecx
cmp edx, ebx
jne 0xf01a8ce
push ebx
push 9
call fcn.0f010c71
test eax, eax
je 0xf01a8ce
push 0xf063b14
call fcn.0f03220a
test eax, eax
je 0xf01a8ce
mov dword [0xf063b14], 1
mov eax, dword [0xf0773e8]
mov ecx, dword [0xf09b55c]
lea eax, [eax + ecx + 0x400]
shl eax, 0xa
push eax
call fcn.0f00e978
call fcn.0f00e56b
cmp dword [0xf06c750], ebx
je 0xf01a96a
push 0x40
mov edi, 0x3000
push edi
lea eax, [ebp - 0x4ec]
push eax
push ebx
lea eax, [ebp - 0x4e0]
push eax
mov dword [ebp - 0x4ec], esi
mov esi, dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
push 0xffffffffffffffff
mov dword [ebp - 0x4e0], 0xc0000
call esi
test eax, eax
jge 0xf01a930
call fcn.0f034856
push 0x40
push edi
lea eax, [ebp - 0x4ec]
push eax
push ebx
lea eax, [ebp - 0x4e0]
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x4e0], 0xf0000
mov dword [ebp - 0x4ec], 0x10000
call esi
test eax, eax
jge 0xf01a963
call fcn.0f034856
call fcn.0f0591d4
jmp 0xf01a96f
call fcn.0f011f09
cmp dword [0xf06bb04], ebx
pop edi
jne 0xf01a9b4
push 6
pop esi
lea eax, [ebp - 0x44]
push eax
push 0xf0022ec
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
mov dword [0xf09b014], eax
jne 0xf01a9b4
cmp esi, ebx
je 0xf01a9a7
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0xf09b014], ebx
jne 0xf01a9b4
mov eax, esi
dec esi
test eax, eax
jne 0xf01a97b
mov dword [0xf09b014], ebx
cmp byte [ebp - 0x1cc], bl
je 0xf01a9c9
lea eax, [ebp - 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.0f014150
call fcn.0f009ed7
push 2
mov byte [0xf06c74c], bl
mov byte [ebp - 0x4e0], 0x33
pop esi
push ebx
push 1
push dword [ebp - 0x4e0]
call fcn.0f00e34d
test ax, ax
jne 0xf01a9fc
inc byte [0xf06c74c]
inc byte [ebp - 0x4e0]
dec esi
jne 0xf01a9e3
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0f01b45c
leave
ret