Function at 0x1007bbd
Capabilities:
Create process on windows
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x1009020]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x614], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x610], eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
xor edi, edi
push eax
mov dword [ebp - 0x620], 4
mov word [ebp - 0x20c], di
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x20c]
push eax
call sub.SHELL32.dll_Ordinal_32
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
call esi
or eax, 0x8001
push eax
call esi
lea eax, [ebp - 0x618]
push eax
push 0x20019
push edi
push 0x1002104
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1007c90
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x624]
push eax
push edi
push 0x10020d8
push dword [ebp - 0x618]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x618]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x1007c90
cmp dword [ebp - 0x61c], edi
je 0x1007c90
mov dword [0x1009018], edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x10020d0
push dword [ebp - 0x610]
call esi
test eax, eax
je 0x1007f33
push 0x10020c8
push dword [ebp - 0x610]
call esi
test eax, eax
je 0x1007f33
mov ebx, dword [ebp - 0x610]
push 0x10020c0
push ebx
call esi
test eax, eax
je 0x1007ef5
push 0x10020b8
push ebx
call esi
test eax, eax
je 0x1007ef5
push 0x10020b0
push ebx
call esi
test eax, eax
je 0x1007ed0
push 0x10020a8
push ebx
call esi
test eax, eax
je 0x1007ed0
push 0x10020a0
push ebx
call esi
test eax, eax
je 0x1007e99
push 0x1002098
push ebx
call esi
test eax, eax
je 0x1007e99
push 0x1002090
push ebx
call esi
test eax, eax
je 0x1007e76
push 0x1002088
push ebx
call esi
test eax, eax
je 0x1007e76
push 0x1002080
push ebx
call esi
test eax, eax
je 0x1007e44
push 0x1002078
push ebx
call esi
test eax, eax
je 0x1007e44
push 0x1002070
push ebx
call esi
test eax, eax
je 0x1007e2d
push 0x1002068
push ebx
call esi
test eax, eax
je 0x1007e2d
push 0x1002060
push ebx
call esi
test eax, eax
je 0x1007e0a
push 0x1002058
push ebx
call esi
test eax, eax
je 0x1007e0a
push 0x1002050
push ebx
call esi
test eax, eax
je 0x1007e04
push 0x1002048
push ebx
call esi
test eax, eax
je 0x1007e04
cmp word [ebx], di
je 0x1007dd3
call fcn.010066d4
push 6
push ebx
push edi
call fcn.0100657d
call fcn.010066e4
jmp 0x1007fbb
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
push 0x1001d20
mov ebx, eax
call fcn.01007778
push 1
push 1
call fcn.0100724f
push edi
push edi
jmp 0x1007f26
mov dword [0x1009018], edi
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
push 0x1001d20
mov ebx, eax
call fcn.01007778
jmp 0x1007e6f
call fcn.010072d8
push 1
push 0x10019e8
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1007fbb
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
push 0x1001d20
mov ebx, eax
call fcn.01007778
xor edi, edi
inc edi
push edi
push edi
call fcn.0100724f
call fcn.01002ebe
jmp 0x1007dfd
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
push edi
push edi
mov ebx, eax
call fcn.0100724f
jmp 0x1007f2b
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
push 0x1001b30
mov ebx, eax
push 0x80000002
xor eax, eax
inc eax
push edi
push eax
push 0x1007235
mov dword [0x1009254], eax
call fcn.010058c7
jmp 0x1007f2b
push 0x1001b30
push 0x80000002
push edi
push edi
push 0x1007235
mov dword [0x1009254], 1
call fcn.010058c7
jmp 0x1007fbb
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
push 0x1001d20
mov ebx, eax
call fcn.01007778
push 1
push edi
call fcn.0100724f
call fcn.01002ebe
push edi
push 1
call fcn.01007b2e
push ebx
call esi
jmp 0x1007fbb
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x100
lea eax, [ebp - 0x40c]
push eax
push 0xc8
push dword [ebp - 0x614]
call esi
lea eax, [ebp - 0x40c]
push eax
call fcn.01006883
push 0x100
lea eax, [ebp - 0x60c]
push eax
push 0xc9
push dword [ebp - 0x614]
call esi
mov esi, dword [sym.imp.SHELL32.dll_GetFileNameFromBrowse]
jmp 0x1007f98
call fcn.010066d4
push 7
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.0100657d
call fcn.010066e4
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0x40c]
push eax
push 0x10018f0
push edi
push ebx
lea eax, [ebp - 0x20c]
push eax
push edi
call esi
test eax, eax
jne 0x1007f7f
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100815d
leave
ret 8