Function at 0x1002fc0e
Capabilities:
Create process on windows
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008671f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1d4
push esi
jmp 0x1002fc49
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp dword [eax], 0
je 0x1003076f
mov dword [ebp - 0x10], 0xcafe
mov dword [ebp - 0x30], 0x93e0566a
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x104], 0x939c0105
mov dword [ebp - 0xec], 0xffffffff
mov dword [ebp - 0xd4], 0x579deb47
mov dword [ebp - 0x118], 0xe6b87c26
push 4
lea ecx, [ebp - 0x150]
call fcn.100189bc
and dword [ebp - 4], 0
mov dword [ebp - 0x58], 0
jmp 0x1002fcb5
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x1002fcd1
push dword [ebp - 0x58]
lea ecx, [ebp - 0x150]
call fcn.10018a43
mov dword [eax], 0xbe76dcb0
jmp 0x1002fcae
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x1002fe53
cmp dword [ebp - 0x10], 3
jbe 0x1002fcf3
mov dword [ebp - 0x10c], 1
jmp 0x1002fcfa
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x10], 0x5fba2522
je 0x1002fd18
mov dword [ebp - 0xa0], 1
jmp 0x1002fd1f
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0xa0]
sub eax, 8
jne 0x1002fd36
mov dword [ebp - 0x108], 1
jmp 0x1002fd3d
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x108]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x30], eax
je 0x1002fd61
mov dword [ebp - 0xe4], 1
jmp 0x1002fd68
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 6
jne 0x1002fd80
mov dword [ebp - 0x7c], 1
jmp 0x1002fd84
and dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x7c]
sub eax, 0xe91c
cmp eax, dword [ebp - 0x10]
jg 0x1002fd9d
mov dword [ebp - 0xc4], 1
jmp 0x1002fda4
and dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x10]
jl 0x1002fdbf
mov dword [ebp - 0x84], 1
jmp 0x1002fdc6
and dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
add eax, 0xffff
jne 0x1002fdf1
cmp dword [ebp - 0x18], 0
je 0x1002fdf1
mov dword [ebp - 0x8c], 1
jmp 0x1002fdf8
and dword [ebp - 0x8c], 0
cmp dword [ebp - 0x8c], 1
ja 0x1002fe0d
mov dword [ebp - 0xcc], 1
jmp 0x1002fe14
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xcc], eax
jle 0x1002fe2b
mov dword [ebp - 0x94], 1
jmp 0x1002fe32
and dword [ebp - 0x94], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xfffffffe
je 0x1002fe53
mov dword [ebp - 0x140], 1
jmp 0x1002fe5a
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x10]
je 0x1002fe80
mov eax, 0xd1cc
test eax, eax
je 0x1002fe80
mov dword [ebp - 0x9c], 1
jmp 0x1002fe87
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x10], 1
jb 0x1002feb1
mov dword [ebp - 0xa4], 1
jmp 0x1002feb8
and dword [ebp - 0xa4], 0
cmp dword [ebp - 0xa4], 0xffffffff
jne 0x1002fecd
mov dword [ebp - 0xfc], 1
jmp 0x1002fed4
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0xfc]
shl eax, 1
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x18], 0
jmp 0x1002fef5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x1002ff31
push dword [ebp - 0x18]
lea ecx, [ebp - 0x150]
call fcn.10018a43
mov esi, eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x150]
call fcn.10018a43
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 0x25], 0
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x1002ff2f
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x1002feee
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.10018a3e
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [eax]
and eax, 0x80000000
je 0x10030023
push 1
lea ecx, [ebp - 0x170]
call fcn.100189bc
mov dword [ebp - 4], 1
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x11c], 0x5d81
mov dword [ebp - 0x134], 0x4bc662a2
mov dword [ebp - 0x4c], 0
jmp 0x1002ff91
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1002ffad
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x170]
call fcn.10018a43
mov dword [eax], 0x73838a1f
jmp 0x1002ff8a
push 0
lea ecx, [ebp - 0x170]
call fcn.10018a43
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0
jmp 0x1002ffcf
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffea
je 0x1002ffe3
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x134], eax
jmp 0x1002ffc8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x170]
call fcn.10018a3e
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [eax]
and eax, 0xffff
push eax
mov eax, dword [ebp + 8]
push dword [eax]
push 0xb40
push 0xdaf
call fcn.100283d1
pop ecx
pop ecx
call eax
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x10030652
mov dword [ebp - 0x1ac], 1
mov byte [ebp - 0x27], 0
movzx eax, byte [ebp - 0x27]
test eax, eax
je 0x10030041
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x10030067
push 0x714
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x3c], 0x718e5034
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0x88], 0xad64de8c
mov dword [ebp - 0x68], 4
mov dword [ebp - 0x98], 0xd4d14b71
mov dword [ebp - 0xb0], 0xffffffff
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0x6511c25c
mov dword [ebp - 0x174], 0xfffffffc
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x130], 0xfffffffe
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x40], 0
jmp 0x100300f7
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1003010a
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x48], 0x262954f6
jmp 0x100300f0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x14], 0
jne 0x1003012b
mov eax, 0x131d
test eax, eax
jne 0x1003012b
and dword [ebp - 0x124], 0
jmp 0x10030135
mov dword [ebp - 0x124], 1
cmp dword [ebp - 0x14], 0
je 0x10030150
mov eax, 0x20f7
test eax, eax
je 0x10030150
mov dword [ebp - 0xac], 1
jmp 0x10030157
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0xac]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jle 0x10030171
mov dword [ebp - 0xdc], 1
jmp 0x10030178
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x10030196
cmp dword [ebp - 0x3c], 0
jne 0x10030196
and dword [ebp - 0xb4], 0
jmp 0x100301a0
mov dword [ebp - 0xb4], 1
cmp dword [ebp - 0xb4], 0xffffffff
je 0x100301b5
mov dword [ebp - 0x13c], 1
jmp 0x100301bc
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffe
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
je 0x100301dd
mov dword [ebp - 0xf4], 1
jmp 0x100301e4
and dword [ebp - 0xf4], 0
cmp dword [ebp - 0xf4], 0x1de9829c
jne 0x100301fc
mov dword [ebp - 0xbc], 1
jmp 0x10030203
and dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xbc], eax
jle 0x10030217
mov dword [ebp - 0x74], 1
jmp 0x1003021b
and dword [ebp - 0x74], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x7eb2
jg 0x10030233
mov dword [ebp - 0x80], 1
jmp 0x10030237
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x68], eax
jg 0x10030255
cmp dword [ebp - 0x14], 0
mov eax, 0x7dfcc86f
test eax, eax
je 0x10030353
mov dword [ebp - 0x1a4], 0x67bc
mov dword [ebp - 0x188], 0xe0f61949
mov dword [ebp - 0x1bc], 0x253674f9
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x194], 0xf12afbc
mov dword [ebp - 0x198], 0x70d8ac50
mov dword [ebp - 0x19c], 3
mov dword [ebp - 0x164], 0xec7a429a
mov dword [ebp - 0x160], 0xec7a429a
mov dword [ebp - 0x15c], 0xec7a429a
mov dword [ebp - 0x158], 0xec7a429a
lea ecx, [ebp - 0x61]
call fcn.10009073
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x1e0]
call fcn.10018a52
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1d8]
call fcn.10018a18
mov dword [ebp - 0x54], 0
jmp 0x10030312
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x10030328
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x90], 0xfffffff8
jmp 0x1003030b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x90]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x90], eax
lea ecx, [ebp - 0x1d8]
call fcn.10018a3e
jmp 0x10030614
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x24], 0
jmp 0x10030371
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x10030494
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x100303ec
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jg 0x100303a4
mov dword [ebp - 0x6c], 1
jmp 0x100303a8
and dword [ebp - 0x6c], 0
cmp dword [ebp - 0x6c], 1
jbe 0x100303ba
mov dword [ebp - 0xa8], 1
jmp 0x100303c1
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
je 0x100303ec
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x48], 0
je 0x100303ec
mov dword [ebp - 0xb8], 1
jmp 0x100303f3
and dword [ebp - 0xb8], 0
cmp dword [ebp - 0xb8], 0
je 0x10030408
mov dword [ebp - 0xc0], 1
jmp 0x1003040f
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x48]
imul ecx, dword [ebp - 0xc0], 0xfe8e
imul eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x38]
cmp eax, 0xfffffffc
jl 0x1003043e
mov dword [ebp - 0xc8], 1
jmp 0x10030445
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x48]
cmp dword [ebp - 0xc8], eax
jle 0x10030460
mov dword [ebp - 0xd0], 1
jmp 0x10030467
and dword [ebp - 0xd0], 0
cmp dword [ebp - 0xd0], 0x94cf7123
jb 0x1003047f
mov dword [ebp - 0xd8], 1
jmp 0x10030486
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x44], eax
jmp 0x1003036a
mov dword [ebp - 0x1c], 0
jmp 0x100304a4
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jg 0x10030614
mov dword [ebp - 0x60], 0xfffffff6
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x138], 0
imul eax, dword [ebp - 0x24], 0x2c2a
test eax, eax
je 0x100304e6
cmp dword [ebp - 0x44], 0
je 0x100304e6
mov dword [ebp - 0x12c], 1
jmp 0x100304ed
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x114]
test eax, eax
je 0x100304ff
cmp dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x60], eax
jg 0x10030513
mov dword [ebp - 0xe0], 1
jmp 0x1003051a
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0xe0], eax
jg 0x10030531
cmp dword [ebp - 0x44], 0
jne 0x10030531
and dword [ebp - 0x5c], 0
jmp 0x10030538
mov dword [ebp - 0x5c], 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x48], ecx
mov eax, dword [ebp - 0x5c]
sub eax, 0x5a08
neg eax
cmp dword [ebp - 0x1c], eax
jge 0x1003055d
mov dword [ebp - 0xe8], 1
jmp 0x10030564
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0xe8], eax
je 0x1003057b
mov dword [ebp - 0xf0], 1
jmp 0x10030582
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xf0]
sub eax, dword [ebp - 0x24]
cmp eax, 0xffff
jae 0x1003059e
mov dword [ebp - 0xf8], 1
jmp 0x100305a5
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x60]
neg eax
add eax, 0x13aa7a40
cmp eax, dword [ebp - 0xf8]
jle 0x100305c3
mov dword [ebp - 0x100], 1
jmp 0x100305ca
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x100]
sub eax, 9
cmp eax, dword [ebp - 0x110]
je 0x100305e7
mov dword [ebp - 0x120], 1
jmp 0x100305ee
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x138], eax
jmp 0x1003049d
mov byte [ebp - 0x28], 0
movzx eax, byte [ebp - 0x28]
test eax, eax
je 0x1003062a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x144]
inc eax
inc eax
push eax
mov eax, dword [ebp + 8]
push dword [eax]
push 0xb40
push 0xdaf
call fcn.100283d1
pop ecx
pop ecx
call eax
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp dword [eax], 0
jne 0x1003076a
mov eax, dword [ebp + 0x18]
and dword [eax], 0
push 2
lea ecx, [ebp - 0x1c8]
call fcn.100189bc
mov dword [ebp - 4], 2
push 2
lea ecx, [ebp - 0x1b8]
call fcn.100189bc
mov byte [ebp - 4], 3
mov dword [ebp - 0x184], 0xfffffff9
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x18c], 0xfffffffd
mov dword [ebp - 0x70], 6
mov dword [ebp - 0x20], 0
jmp 0x100306bd
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x100306d6
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c8]
call fcn.10018a43
and dword [eax], 0
jmp 0x100306b6
mov dword [ebp - 0x20], 0
jmp 0x100306e6
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10030702
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1b8]
call fcn.10018a43
mov dword [eax], 0x20b95ae6
jmp 0x100306df
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x50], 0
jmp 0x10030719
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xfffffff7
jl 0x1003074a
mov byte [ebp - 0x26], 0
movzx eax, byte [ebp - 0x26]
test eax, eax
je 0x10030748
push 0
push 0x528
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
jmp 0x10030712
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1b8]
call fcn.10018a3e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c8]
call fcn.10018a3e
jmp 0x1003076f
jmp 0x1002fc2f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret