Function at 0x1001d3d4
Capabilities:
Create process on windows
Get common file path
Set registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x64
mov eax, 0x100578e5
call fcn.10039bd1
mov esi, dword [ebp + 0x214]
xor ebx, ebx
test byte [ebp + 0x220], 1
je 0x1001d40f
mov byte [ebp + 0x218], bl
push esi
lea ecx, [ebp - 0x18]
call fcn.10001309
push 0x1006127c
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.10001309
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.10001524
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], bl
cmp ecx, ebx
je 0x1001d447
call fcn.10001441
cmp byte [ebp + 0x21c], bl
je 0x1001d7dd
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call fcn.10039d40
add esp, 0xc
push esi
lea ecx, [ebp - 0x1c]
call fcn.10001309
mov edi, dword [ebp - 0x1c]
mov byte [ebp - 4], 2
cmp edi, ebx
je 0x1001d488
mov ecx, edi
call fcn.10028aad
jmp 0x1001d48a
xor eax, eax
push eax
push str.wsdetect.dll
call fcn.1001b87c
movzx esi, ax
mov eax, 0x8664
pop ecx
pop ecx
cmp ax, si
jne 0x1001d4b6
mov esi, 0x104
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
jmp 0x1001d4d2
mov eax, 0x14c
cmp ax, si
jne 0x1001d719
lea esi, [eax - 0x48]
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.kernel32.dll_GetSystemWow64DirectoryW]
push str._regsvr32.exe
lea eax, [ebp]
push esi
push eax
call fcn.10035fb0
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.10039d40
add esp, 0x18
push 0x100614a8
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x70], esi
call fcn.10001309
mov byte [ebp - 4], 7
cmp byte [ebp + 0x218], bl
jne 0x1001d53b
push 0x100614b0
lea ecx, [ebp - 0x10]
call fcn.10001309
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 7
cmp ecx, ebx
je 0x1001d53b
call fcn.10001441
push 0x100614b8
lea ecx, [ebp - 0x10]
call fcn.10001309
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 9
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 7
cmp ecx, ebx
je 0x1001d568
call fcn.10001441
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.10001524
push 0x100614bc
lea ecx, [ebp - 0x10]
call fcn.10001309
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xa
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 7
cmp ecx, ebx
je 0x1001d5a1
call fcn.10001441
mov edi, dword [ebp - 0x20]
xor esi, esi
inc esi
lea eax, [ebp]
mov dword [ebp - 0x64], 0x100614c0
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x6c], 0x40
cmp edi, ebx
je 0x1001d5c9
mov eax, dword [edi]
mov dword [ebp - 0x5c], eax
jmp 0x1001d5cc
mov dword [ebp - 0x5c], ebx
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x24], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1001d603
cmp dword [ebp - 0x38], ebx
je 0x1001d603
push 0xffffffffffffffff
push dword [ebp - 0x38]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
push dword [ebp - 0x38]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [ebp - 0x24], ebx
je 0x1001d6ef
push str.regsvr32.exe_error__
lea ecx, [ebp - 0x10]
call fcn.1001060c
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
call fcn.10001309
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xc
call fcn.10001524
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xb
cmp ecx, ebx
je 0x1001d649
call fcn.10001441
push str.___error_code:
lea ecx, [ebp - 0x14]
call fcn.1001060c
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xd
call fcn.10001524
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x1001d672
call fcn.10001441
push 0x13
pop eax
mov word [ebp - 0x34], ax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xe
call fcn.1000535c
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xf
call fcn.10001524
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x1001d6ab
call fcn.10001441
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, dword [ebp - 0x10]
cmp esi, ebx
je 0x1001d6c0
mov eax, dword [esi]
jmp 0x1001d6c2
xor eax, eax
push eax
call fcn.10035fb0
pop ecx
cmp esi, ebx
je 0x1001d6d4
mov ecx, esi
call fcn.10001441
cmp edi, ebx
je 0x1001d6df
mov ecx, edi
call fcn.10001441
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x1001d7ca
jmp 0x1001d7c5
cmp edi, ebx
je 0x1001d6fa
mov ecx, edi
call fcn.10001441
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x1001d706
call fcn.10001441
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x1001d712
call fcn.10001441
mov eax, esi
jmp 0x1001d94c
push str.Unexpected_machine_type_from__
lea ecx, [ebp - 0x10]
call fcn.1001060c
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.10001524
push str.___machine_type:
lea ecx, [ebp - 0x14]
call fcn.1001060c
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.10001524
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x1001d75f
call fcn.10001441
push 0x12
pop eax
mov word [ebp - 0x34], ax
mov word [ebp - 0x2c], si
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.1000535c
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.10001524
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x1001d796
call fcn.10001441
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, dword [ebp - 0x10]
cmp esi, ebx
je 0x1001d7ab
mov eax, dword [esi]
jmp 0x1001d7ad
xor eax, eax
push eax
call fcn.10035fb0
pop ecx
cmp esi, ebx
je 0x1001d7bf
mov ecx, esi
call fcn.10001441
cmp edi, ebx
je 0x1001d7ca
mov ecx, edi
call fcn.10001441
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x1001d7d6
call fcn.10001441
xor eax, eax
jmp 0x1001d94c
mov edi, dword [ebp - 0x18]
cmp edi, ebx
je 0x1001d7e8
mov eax, dword [edi]
jmp 0x1001d7ea
xor eax, eax
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
jne 0x1001d8b7
call dword [sym.imp.kernel32.dll_GetLastError]
push str.Failed_to_load__
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.1001060c
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x10
call fcn.10001524
push str.___error_code
lea ecx, [ebp - 0x14]
call fcn.1001060c
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x11
call fcn.10001524
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x1001d849
call fcn.10001441
push 0x13
pop eax
mov word [ebp - 0x34], ax
mov dword [ebp - 0x2c], esi
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x12
call fcn.1000535c
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x13
call fcn.10001524
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x1001d87f
call fcn.10001441
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, dword [ebp - 0x10]
cmp esi, ebx
je 0x1001d894
mov eax, dword [esi]
jmp 0x1001d896
xor eax, eax
push eax
call fcn.10035fb0
pop ecx
cmp esi, ebx
je 0x1001d8a8
mov ecx, esi
call fcn.10001441
cmp edi, ebx
je 0x1001d7d6
mov ecx, edi
jmp 0x1001d7d1
mov edi, 0x10061518
cmp byte [ebp + 0x218], bl
jne 0x1001d8c9
mov edi, 0x1006152c
push edi
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
cmp eax, ebx
jne 0x1001d92e
push str.Failed_to_get_proc_address:
lea ecx, [ebp - 0x1c]
call fcn.1001060c
push edi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x14
call fcn.1001060c
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x15
call fcn.10001524
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x1001d90b
call fcn.10001441
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
je 0x1001d916
mov eax, dword [esi]
jmp 0x1001d918
xor eax, eax
push eax
call fcn.10035fb0
pop ecx
cmp esi, ebx
je 0x1001d7ca
mov ecx, esi
jmp 0x1001d7c5
call eax
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_CoFreeUnusedLibraries]
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x1001d949
call fcn.10001441
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10039bc2
add ebp, 0x20c
leave
ret