Function at 0x1007792
Capabilities:
Create process on windows
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
push ebx
push esi
push edi
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x218]
xor edi, edi
push eax
mov dword [ebp - 8], 4
mov word [ebp - 0x218], di
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
call sub.SHELL32.dll_Ordinal_32
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
call esi
or eax, 0x8001
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push 0x1002450
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1007831
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x1002424
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x1007831
cmp dword [ebp - 0xc], edi
je 0x1007831
mov dword [0x1009008], edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x100241c
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x1007acf
push 0x1002414
push dword [ebp + 0xc]
call esi
test eax, eax
je 0x1007acf
mov ebx, dword [ebp + 0xc]
push 0x100240c
push ebx
call esi
test eax, eax
je 0x1007a90
push 0x1002404
push ebx
call esi
test eax, eax
je 0x1007a90
push 0x10023fc
push ebx
call esi
test eax, eax
je 0x1007a6b
push 0x10023f4
push ebx
call esi
test eax, eax
je 0x1007a6b
push 0x10023ec
push ebx
call esi
test eax, eax
je 0x1007a34
push 0x10023e4
push ebx
call esi
test eax, eax
je 0x1007a34
push 0x10023dc
push ebx
call esi
test eax, eax
je 0x1007a11
push 0x10023d4
push ebx
call esi
test eax, eax
je 0x1007a11
push 0x10023cc
push ebx
call esi
test eax, eax
je 0x10079de
push 0x10023c4
push ebx
call esi
test eax, eax
je 0x10079de
push 0x10023bc
push ebx
call esi
test eax, eax
je 0x10079c7
push 0x10023b4
push ebx
call esi
test eax, eax
je 0x10079c7
push 0x10023ac
push ebx
call esi
test eax, eax
je 0x10079a3
push 0x10023a4
push ebx
call esi
test eax, eax
je 0x10079a3
push 0x100239c
push ebx
call esi
test eax, eax
je 0x100799d
push 0x1002394
push ebx
call esi
test eax, eax
je 0x100799d
cmp word [ebx], di
je 0x100796b
call fcn.01006604
push 6
push ebx
push edi
call fcn.010053e3
call fcn.0100660f
jmp 0x1007b51
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
push edi
push 0x1002068
mov ebx, eax
call fcn.010072f2
push 1
push 1
call fcn.0100706d
push edi
push edi
jmp 0x1007ac2
mov dword [0x1009008], edi
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
push edi
push 0x1002068
mov ebx, eax
call fcn.010072f2
jmp 0x1007a0a
call fcn.010070d1
push 1
push 0x1001d30
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1007b51
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
push edi
push 0x1002068
mov ebx, eax
call fcn.010072f2
xor edi, edi
inc edi
push edi
push edi
call fcn.0100706d
call fcn.01003742
jmp 0x1007996
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
push edi
push edi
mov ebx, eax
call fcn.0100706d
jmp 0x1007ac7
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
push 0x1001e78
mov ebx, eax
push 0x80000002
xor eax, eax
inc eax
push edi
push eax
push 0x100705d
mov dword [0x100923c], eax
call fcn.010063c6
jmp 0x1007ac7
push 0x1001e78
push 0x80000002
push edi
push edi
push 0x100705d
mov dword [0x100923c], 1
call fcn.010063c6
jmp 0x1007b51
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
push edi
push 0x1002068
mov ebx, eax
call fcn.010072f2
push 1
push edi
call fcn.0100706d
call fcn.01003742
push edi
push 1
call fcn.0100770a
push ebx
call esi
jmp 0x1007b51
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x100
lea eax, [ebp - 0x418]
push eax
push 0xc8
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x418]
push eax
call fcn.01006af6
push 0x100
lea eax, [ebp - 0x618]
push eax
push 0xc9
push dword [ebp + 8]
call esi
mov esi, dword [sym.imp.SHELL32.dll_GetFileNameFromBrowse]
jmp 0x1007b2e
call fcn.01006604
push 7
lea eax, [ebp - 0x218]
push eax
push edi
call fcn.010053e3
call fcn.0100660f
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x418]
push eax
push 0x1001c38
push edi
push ebx
lea eax, [ebp - 0x218]
push eax
push edi
call esi
test eax, eax
jne 0x1007b15
pop edi
pop esi
pop ebx
leave
ret 8