Function at 0x1000b93b
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7ac]
sub esp, 0x82c
mov eax, dword [0x1002b1f0]
xor eax, ebp
mov dword [ebp + 0x7a8], eax
push ebx
push esi
mov esi, dword [ebp + 0x7b4]
xor ebx, ebx
cmp esi, ebx
je 0x1000bb89
push esi
call dword [sym.imp.MSVCR90.dll_wcslen]
pop ecx
test eax, eax
jbe 0x1000bb89
push esi
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea eax, [ebp - 0x78]
push eax
push 0x20019
push ebx
push str.Applicationsiexplore.exe_shellopencommand
push SysReAllocString
mov dword [ebp - 0x78], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000bb31
push edi
push 0x7fe
mov word [ebp - 0x58], ax
xor edi, edi
lea eax, [ebp - 0x56]
push ebx
inc edi
push eax
mov dword [ebp - 0x80], edi
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x1001d410
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000bad8
cmp dword [ebp - 0x80], edi
jne 0x1000bad8
cmp dword [ebp - 0x7c], ebx
jbe 0x1000bad8
lea edi, [ebp - 0x58]
cmp word [ebp - 0x58], bx
je 0x1000ba25
movzx eax, word [ebp - 0x58]
cmp ax, 0x20
jne 0x1000ba1d
inc edi
inc edi
movzx eax, word [edi]
cmp ax, bx
jne 0x1000ba0d
movzx eax, word [edi]
cmp ax, bx
jne 0x1000ba66
mov esi, 0x1001ef48
push esi
call fcn.10005425
pop ecx
test eax, eax
jne 0x1000ba53
push 1
push 0x1001ef44
push ebx
push esi
call fcn.10009855
pop ecx
pop ecx
mov ecx, eax
call fcn.100016a4
mov ecx, eax
call fcn.1000a33f
cmp dword [ebp - 0x5c], 8
mov eax, dword [ebp - 0x70]
jae 0x1000ba5f
lea eax, [ebp - 0x70]
push 1
jmp 0x1000bb12
xor ecx, ecx
cmp ax, 0x22
jne 0x1000ba71
inc edi
inc edi
inc ecx
xor eax, eax
cmp ecx, ebx
setne al
lea eax, [eax + eax + 0x20]
push eax
push edi
call dword [sym.imp.MSVCR90.dll_wcschr]
pop ecx
pop ecx
cmp eax, ebx
je 0x1000ba8f
xor ecx, ecx
mov word [eax], cx
mov esi, 0x1001ef48
push esi
call fcn.10005425
pop ecx
test eax, eax
jne 0x1000bac5
push 1
push edi
push 0x1001ef40
push ebx
push esi
call fcn.10009855
pop ecx
pop ecx
mov ecx, eax
call fcn.100016a4
mov ecx, eax
call fcn.100016a4
mov ecx, eax
call fcn.1000a33f
cmp dword [ebp - 0x5c], 8
mov eax, dword [ebp - 0x70]
jae 0x1000bad1
lea eax, [ebp - 0x70]
push 1
push ebx
push eax
push edi
jmp 0x1000bb19
mov esi, 0x1001ef48
push esi
call fcn.10005425
pop ecx
test eax, eax
jne 0x1000bb05
push edi
push 0x1001ef3c
push ebx
push esi
call fcn.10009855
pop ecx
pop ecx
mov ecx, eax
call fcn.100016a4
mov ecx, eax
call fcn.1000a33f
cmp dword [ebp - 0x5c], 8
mov eax, dword [ebp - 0x70]
jae 0x1000bb11
lea eax, [ebp - 0x70]
push edi
push ebx
push eax
push str.iexplore
push 0x1001ef1c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
jmp 0x1000bb80
mov esi, 0x1001ef48
push esi
call fcn.10005425
pop ecx
test eax, eax
jne 0x1000bb5f
push 1
push 0x1001ef3c
push ebx
push esi
call fcn.10009855
pop ecx
pop ecx
mov ecx, eax
call fcn.100016a4
mov ecx, eax
call fcn.1000a33f
cmp dword [ebp - 0x5c], 8
mov eax, dword [ebp - 0x70]
jae 0x1000bb6b
lea eax, [ebp - 0x70]
push 1
push ebx
push eax
push str.iexplore
push 0x1001ef1c
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [ebp + 0x7a8]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10018dd2
add ebp, 0x7ac
leave
ret