Function at 0x1001c320
Capabilities:
Create process on windows
Get common file path
Resolve function by parsing pe exports
Set registry value

Disassembly:
sub esp, 0x270
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x26c], eax
mov al, byte [esp + 0x278]
mov ecx, 0
test byte [esp + 0x280], 1
push ebx
push esi
movzx eax, al
push edi
mov edi, dword [esp + 0x280]
cmove ecx, eax
push 0xc
mov dword [esp + 0x10], ecx
call fcn.10031690
mov ebx, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
add esp, 4
test esi, esi
je 0x1001c393
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call ebx
mov dword [esi], eax
test eax, eax
jne 0x1001c395
test edi, edi
jne 0x1001ce12
jmp 0x1001c395
xor esi, esi
mov dword [esp + 0x1c], esi
test esi, esi
je 0x1001ce12
push 0xc
call fcn.10031690
mov esi, eax
add esp, 4
test esi, esi
je 0x1001c3d2
push 0x100426cc
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call ebx
mov dword [esi], eax
test eax, eax
je 0x1001ce12
jmp 0x1001c3d4
xor esi, esi
mov dword [esp + 0x10], esi
test esi, esi
je 0x1001ce12
push ebp
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
call fcn.10003700
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
mov ebp, dword [sym.imp.OLEAUT32.dll_SysStringLen]
jne 0x1001c433
mov eax, dword [esi]
test eax, eax
je 0x1001c411
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001c428
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
cmp byte [esp + 0x28c], 0
je 0x1001cb82
push 0x208
lea eax, [esp + 0x78]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [esp + 0x1c]
push edi
call fcn.100032a0
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x1001c47a
mov eax, dword [edi + 4]
test eax, eax
jne 0x1001c47c
push dword [edi]
call fcn.10031690
mov dword [edi + 4], eax
jmp 0x1001c47c
xor eax, eax
push eax
push str.wsdetect.dll
call dword [sym.imp.imagehlp.dll_ImageLoad]
mov ecx, eax
test ecx, ecx
je 0x1001c9d4
mov eax, dword [ecx + 0xc]
push ecx
movzx esi, word [eax + 4]
call dword [sym.imp.imagehlp.dll_ImageUnload]
test eax, eax
je 0x1001c9d4
mov eax, esi
mov dword [esp + 0x14], eax
mov eax, 0x8664
cmp ax, si
jne 0x1001c4ca
push 0x104
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
jmp 0x1001c4e8
mov eax, 0x14c
cmp ax, si
jne 0x1001c9dc
push 0x104
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.kernel32.dll_GetSystemWow64DirectoryW]
push str._regsvr32.exe
lea eax, [esp + 0x78]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
xorps xmm0, xmm0
mov dword [esp + 0x44], 0x3c
push 0xc
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
call fcn.10031690
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001c569
push 0x10042748
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call edi
mov dword [esi], eax
test eax, eax
je 0x1001ce1c
jmp 0x1001c56b
xor esi, esi
mov dword [esp + 0x18], esi
test esi, esi
je 0x1001ce1c
cmp byte [esp + 0x10], 0
jne 0x1001c60a
push 0xc
call fcn.10031690
mov esi, eax
add esp, 4
test esi, esi
je 0x1001c5b3
push 0x10042750
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call edi
mov dword [esi], eax
test eax, eax
je 0x1001ce1c
jmp 0x1001c5b5
xor esi, esi
mov dword [esp + 0x10], esi
test esi, esi
je 0x1001ce1c
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call fcn.10003700
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001c60a
mov eax, dword [esi]
test eax, eax
je 0x1001c5e8
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001c5ff
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
push 0xc
call fcn.10031690
mov esi, eax
add esp, 4
test esi, esi
je 0x1001c63b
push 0x1003ffe4
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call edi
mov dword [esi], eax
test eax, eax
je 0x1001ce1c
jmp 0x1001c63d
xor esi, esi
mov dword [esp + 0x10], esi
test esi, esi
je 0x1001ce1c
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call fcn.10003700
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001c692
mov eax, dword [esi]
test eax, eax
je 0x1001c670
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001c687
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
call fcn.10003700
push 0xc
call fcn.10031690
mov esi, eax
add esp, 4
test esi, esi
je 0x1001c6d1
push 0x1003ffe4
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call edi
mov dword [esi], eax
test eax, eax
je 0x1001ce1c
jmp 0x1001c6d3
xor esi, esi
mov dword [esp + 0x10], esi
test esi, esi
je 0x1001ce1c
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call fcn.10003700
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001c728
mov eax, dword [esi]
test eax, eax
je 0x1001c706
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001c71d
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x74]
mov dword [esp + 0x44], str.open
mov dword [esp + 0x48], eax
mov dword [esp + 0x54], 1
mov dword [esp + 0x3c], 0x40
test edi, edi
je 0x1001c758
mov eax, dword [edi]
mov dword [esp + 0x4c], eax
jmp 0x1001c760
mov dword [esp + 0x4c], 0
lea eax, [esp + 0x38]
mov dword [esp + 0x24], 1
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1001c7a1
mov eax, dword [esp + 0x70]
test eax, eax
je 0x1001c7a1
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x74]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
push dword [esp + 0x70]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [esp + 0x24], 0
je 0x1001c983
push str.regsvr32.exe_error__
lea ecx, [esp + 0x1c]
call fcn.100060b0
push 0xc
call fcn.10031690
mov esi, eax
add esp, 4
test esi, esi
je 0x1001c7ef
lea eax, [esp + 0x74]
mov dword [esi + 4], 0
push eax
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x1001ce1c
jmp 0x1001c7f1
xor esi, esi
mov dword [esp + 0x10], esi
test esi, esi
je 0x1001ce1c
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call fcn.10003700
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001c846
mov eax, dword [esi]
test eax, eax
je 0x1001c824
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001c83b
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
push str.___error_code:
lea ecx, [esp + 0x18]
call fcn.100060b0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
call fcn.10003700
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1001c8a5
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001c8a5
mov eax, dword [esi]
test eax, eax
je 0x1001c883
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001c89a
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov eax, 0x13
lea ecx, [esp + 0x14]
mov word [esp + 0x28], ax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
call fcn.10015c90
push eax
lea ecx, [esp + 0x1c]
call fcn.10003700
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1001c91e
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001c916
test esi, esi
je 0x1001c916
mov eax, dword [esi]
test eax, eax
je 0x1001c8f4
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001c90b
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov dword [esp + 0x14], 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, dword [esp + 0x18]
test esi, esi
je 0x1001c935
mov eax, dword [esi]
jmp 0x1001c937
xor eax, eax
push eax
call fcn.10003ca0
add esp, 4
test esi, esi
je 0x1001c97f
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001c97f
mov eax, dword [esi]
test eax, eax
je 0x1001c95d
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001c974
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
xor esi, esi
jmp 0x1001c988
mov esi, 1
test edi, edi
je 0x1001cb36
mov eax, ebx
lock xadd dword [edi + 8], eax
dec eax
jne 0x1001cb36
mov eax, dword [edi]
test eax, eax
je 0x1001c9ad
push eax
call ebp
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x1001c9c4
push eax
call fcn.1003b898
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.10031690
add esp, 8
jmp 0x1001cb36
mov dword [esp + 0x14], 0
push str.Unexpected_machine_type_from__
lea ecx, [esp + 0x1c]
call fcn.100060b0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
call fcn.10003700
push str.___machine_type:
lea ecx, [esp + 0x20]
call fcn.100060b0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
call fcn.10003700
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x1001ca57
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001ca57
mov eax, dword [esi]
test eax, eax
je 0x1001ca35
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001ca4c
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov eax, 0x12
lea ecx, [esp + 0x14]
mov word [esp + 0x28], ax
mov eax, dword [esp + 0x14]
mov word [esp + 0x30], ax
lea eax, [esp + 0x28]
push eax
call fcn.10015c90
push eax
lea ecx, [esp + 0x1c]
call fcn.10003700
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1001cad1
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001cac9
test esi, esi
je 0x1001cac9
mov eax, dword [esi]
test eax, eax
je 0x1001caa7
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001cabe
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov dword [esp + 0x14], 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, dword [esp + 0x18]
test esi, esi
je 0x1001cae8
mov eax, dword [esi]
jmp 0x1001caea
xor eax, eax
push eax
call fcn.10003ca0
add esp, 4
test esi, esi
je 0x1001cb32
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001cb32
mov eax, dword [esi]
test eax, eax
je 0x1001cb10
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001cb27
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
xor esi, esi
jmp 0x1001cb3a
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x1001cb79
mov eax, ebx
lock xadd dword [edi + 8], eax
dec eax
jne 0x1001cb79
mov eax, dword [edi]
test eax, eax
je 0x1001cb57
push eax
call ebp
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x1001cb6e
push eax
call fcn.1003b898
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.10031690
add esp, 8
mov edi, dword [esp + 0x20]
jmp 0x1001cdba
mov edi, dword [esp + 0x20]
test edi, edi
je 0x1001cb8e
mov eax, dword [edi]
jmp 0x1001cb90
xor eax, eax
push eax
call fcn.10031690
mov dword [esp + 0x14], eax
test eax, eax
jne 0x1001ccbe
call dword [sym.imp.kernel32.dll_GetLastError]
push str.Failed_to_load__
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call fcn.100060b0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
call fcn.10003700
push str.___error_code
lea ecx, [esp + 0x18]
call fcn.100060b0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
call fcn.10003700
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1001cc27
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001cc27
mov eax, dword [esi]
test eax, eax
je 0x1001cc05
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001cc1c
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov eax, 0x13
lea ecx, [esp + 0x14]
mov word [esp + 0x28], ax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
call fcn.10015c90
push eax
lea ecx, [esp + 0x20]
call fcn.10003700
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1001cca0
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001cc98
test esi, esi
je 0x1001cc98
mov eax, dword [esi]
test eax, eax
je 0x1001cc76
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001cc8d
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov dword [esp + 0x14], 0
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x1001cd55
mov eax, dword [esi]
jmp 0x1001cd57
cmp byte [esp + 0x10], 0
mov ecx, str.DllUnregisterServer
mov esi, str.DllRegisterServer
cmove esi, ecx
push esi
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
jne 0x1001cda3
push str.Failed_to_get_proc_address:
lea ecx, [esp + 0x18]
call fcn.100060b0
push esi
lea ecx, [esp + 0x14]
call fcn.100060b0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
call fcn.10003700
mov esi, dword [esp + 0x10]
test esi, esi
je 0x1001cd49
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001cd49
mov eax, dword [esi]
test eax, eax
je 0x1001cd27
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001cd3e
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1001cd55
mov eax, dword [esi]
jmp 0x1001cd57
xor eax, eax
push eax
call fcn.10003ca0
add esp, 4
test esi, esi
je 0x1001cd9f
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001cd9f
mov eax, dword [esi]
test eax, eax
je 0x1001cd7d
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001cd94
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
xor esi, esi
jmp 0x1001cdba
call eax
push dword [esp + 0x14]
call dword [sym.imp.kernel32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_CoFreeUnusedLibraries]
mov esi, 1
test edi, edi
je 0x1001cdf7
lock xadd dword [edi + 8], ebx
dec ebx
jne 0x1001cdf7
mov eax, dword [edi]
test eax, eax
je 0x1001cdd5
push eax
call ebp
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x1001cdec
push eax
call fcn.1003b898
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.10031690
add esp, 8
mov ecx, dword [esp + 0x27c]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003b4ee
add esp, 0x270
ret
push 0x8007000e
call fcn.10031690
push 0x8007000e
call fcn.10031690
int3