Function at 0xf02f2d2
Capabilities:
Allocate or change rwx memory
Get process heap flags
Query or enumerate registry value
Set console window title
Set current directory
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x698
mov eax, dword [0xf072008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x104
xor ebx, ebx
push esi
lea eax, [ebp - 0x2d3]
push ebx
push eax
mov byte [ebp - 0x2d4], bl
call fcn.0f0060e0
push 0x80
lea eax, [ebp - 0xc7]
push ebx
push eax
mov byte [ebp - 0xc8], bl
call fcn.0f0060e0
add esp, 0x18
mov dword [ebp - 0x5f4], 0x3a3f3d
cmp dword [0xf07df54], ebx
jne 0xf02f336
call fcn.0f02ef8d
push edi
lea eax, [ebp - 0x5f0]
push eax
xor edi, edi
inc edi
push edi
push ebx
push 0xf002fa8
push 0x80000002
mov dword [ebp - 0x5f8], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf02f3af
lea eax, [ebp - 0x5f8]
push eax
lea eax, [ebp - 0x3d4]
push eax
push ebx
push ebx
push 0xf002f9c
push dword [ebp - 0x5f0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf02f3a3
lea eax, [ebp - 0x3d4]
push 0xf002f94
push eax
call fcn.0f05f160
pop ecx
pop ecx
test eax, eax
je 0xf02f3a3
mov dword [0xf07ec38], edi
push dword [ebp - 0x5f0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x1cc], bl
cmp dword [0xf07df54], ebx
jne 0xf02f419
cmp dword [0xf07df5c], ebx
jne 0xf02f3dd
push esi
lea eax, [ebp - 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
test eax, eax
jne 0xf02f3dd
mov byte [ebp - 0x1cc], bl
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0xf002f80
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.0f05e98d
add esp, 0x18
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
jmp 0xf02f443
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
push dword [eax + 0x10]
lea eax, [ebp - 0x1cc]
push dword [0xf07df60]
push 0xf002f5c
push esi
push eax
call fcn.0f05e98d
add esp, 0x14
mov ecx, dword [sym.ntvdm.exe_fSeparateWow]
lea eax, [ebp - 0x5e0]
mov dword [ebp - 0x674], eax
mov eax, esi
mov word [ebp - 0x604], ax
mov eax, dword [0xf07df54]
mov dword [ebp - 0x668], ebx
mov dword [ebp - 0x66c], ebx
cmp ecx, ebx
je 0xf02f47a
mov edx, 0x900
jmp 0xf02f485
mov edx, 0x102
cmp eax, ebx
jne 0xf02f485
mov edx, esi
mov word [ebp - 0x600], dx
xor edx, edx
mov dword [ebp - 0x67c], ebx
mov word [ebp - 0x608], dx
mov dword [ebp - 0x678], ebx
mov word [ebp - 0x606], dx
cmp eax, ebx
je 0xf02f4b6
cmp ecx, ebx
mov ecx, dword [0xf07df60]
je 0xf02f4bc
mov ecx, dword [0xf07df5c]
mov dword [ebp - 0x698], ecx
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffffff7f
add ecx, 0x81
neg eax
sbb eax, eax
not eax
mov dword [ebp - 0x60c], ecx
lea ecx, [ebp - 0xc8]
and eax, ecx
mov dword [ebp - 0x610], eax
mov eax, 0x105
mov word [ebp - 0x602], ax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x620], ebx
mov dword [ebp - 0x61c], ebx
mov dword [ebp - 0x670], eax
cmp byte [ebp - 0x1cc], bl
jne 0xf02f52e
lea eax, [ebp - 0x1cc]
mov dword [ebp - 0x618], eax
mov dword [ebp - 0x614], esi
jmp 0xf02f53a
mov dword [ebp - 0x618], ebx
mov dword [ebp - 0x614], ebx
lea eax, [ebp - 0x698]
push eax
mov byte [ebp - 0x5e0], bl
mov byte [0xf0ada69], bl
mov byte [0xf0ada6a], bl
mov byte [0xf0ada6b], bl
call sub.KERNEL32.dll_GetNextVDMCommand
test eax, eax
je 0xf02f620
mov byte [ebp - 0x48], bl
cmp dword [0xf07df54], ebx
jne 0xf02f5ea
cmp dword [ebp - 0x60c], ebx
je 0xf02f5ea
lea eax, [ebp - 0xc8]
push 0xf002f54
push eax
call fcn.0f05f160
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0xf02f5ea
add esi, 6
cmp byte [esi], 0x30
mov eax, esi
jl 0xf02f5ea
cmp byte [esi], 0x39
jg 0xf02f5a7
inc esi
cmp byte [esi], 0x30
jge 0xf02f59c
cmp eax, esi
je 0xf02f5ea
mov cl, byte [esi]
push 0xa
push ebx
push eax
mov byte [ebp - 0x5e1], cl
mov byte [esi], bl
call fcn.0f00df98
mov cl, byte [ebp - 0x5e1]
add esp, 0xc
mov byte [esi], cl
test al, 1
je 0xf02f5d4
mov byte [0xf0ada6a], 1
test al, 2
je 0xf02f5df
mov byte [0xf0ada6b], 1
test al, 4
je 0xf02f5ea
mov byte [0xf0ada69], 1
cmp word [ebp - 0x602], bx
je 0xf02f620
mov al, byte [ebp - 0x2d4]
mov byte [ebp - 0x5f3], al
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x5f4]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [ebp - 0x5e0], bl
mov byte [0xf0ada6c], bl
setne al
mov byte [0xf0ada6d], bl
mov byte [0xf0ada68], al
cmp dword [0xf07df54], ebx
je 0xf02f664
mov dword [0xf07df5c], ebx
mov byte [0xf0ada6a], 1
mov byte [0xf0ada69], 1
mov byte [0xf0ada6c], 1
mov byte [0xf0ada6b], 1
lea eax, [ebp - 0x5e0]
push eax
call fcn.0f02ecae
call fcn.0f043f41
mov edi, dword [0xf07df54]
mov esi, 0x8000
cmp edi, ebx
je 0xf02f696
mov dword [0xf0ada3c], ebx
mov dword [0xf0899dc], 0x3c00
jmp 0xf02f701
mov ax, word [0xf07ec2c]
mov ecx, 0xffff
mov edx, ecx
cmp ax, dx
jne 0xf02f6b4
mov dword [0xf0ada3c], 0x1000
jmp 0xf02f6bc
movzx eax, ax
mov dword [0xf0ada3c], eax
mov ax, word [0xf07ec28]
mov ecx, 0x3c00
cmp ax, dx
jne 0xf02f6d0
mov eax, ecx
jmp 0xf02f6d3
movzx eax, ax
mov dword [0xf0899dc], eax
cmp dword [0xf0ada3c], esi
jbe 0xf02f6e6
mov dword [0xf0ada3c], esi
mov edx, 0x400
cmp eax, edx
jae 0xf02f6f7
mov dword [0xf0899dc], edx
jmp 0xf02f705
cmp eax, ecx
jbe 0xf02f705
mov dword [0xf0899dc], ecx
cmp edi, ebx
jne 0xf02f729
push ebx
push 9
call fcn.0f02f0e6
test eax, eax
je 0xf02f729
push 0xf07559c
call fcn.0f02a059
test eax, eax
je 0xf02f729
mov dword [0xf07559c], 1
mov eax, dword [0xf0899dc]
mov ecx, dword [0xf0ada3c]
lea eax, [eax + ecx + 0x400]
shl eax, 0xa
push eax
call fcn.0f04461c
call fcn.0f03c063
pop edi
cmp dword [0xf07ec38], ebx
je 0xf02f7c4
push 0x40
mov dword [ebp - 0x5ec], esi
mov esi, 0x3000
push esi
lea eax, [ebp - 0x5ec]
push eax
push ebx
lea eax, [ebp - 0x5e8]
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x5e8], 0xc0000
call sub.ntdll.dll_NtAllocateVirtualMemory
test eax, eax
jge 0xf02f789
call fcn.0f02d021
push 0x40
push esi
lea eax, [ebp - 0x5ec]
push eax
push ebx
lea eax, [ebp - 0x5e8]
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x5e8], 0xf0000
mov dword [ebp - 0x5ec], 0x10000
call sub.ntdll.dll_NtAllocateVirtualMemory
test eax, eax
jge 0xf02f7bf
call fcn.0f02d021
call fcn.0f0675af
cmp dword [0xf07df54], ebx
jne 0xf02f808
push 6
pop esi
lea eax, [ebp - 0x44]
push eax
push 0xf002f40
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [0xf0ad4b8], eax
cmp eax, ebx
jne 0xf02f808
cmp esi, ebx
je 0xf02f7fb
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0xf0ad4b8], ebx
jne 0xf02f808
mov eax, esi
dec esi
test eax, eax
jne 0xf02f7cf
mov dword [0xf0ad4b8], ebx
cmp byte [ebp - 0x1cc], bl
je 0xf02f81d
lea eax, [ebp - 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.0f039edb
call fcn.0f02eeaf
push 2
mov byte [0xf07ec2a], bl
mov byte [ebp - 0x5e8], 0x33
pop esi
push ebx
push 1
push dword [ebp - 0x5e8]
call fcn.0f01e4cf
test ax, ax
jne 0xf02f850
inc byte [0xf07ec2a]
inc byte [ebp - 0x5e8]
dec esi
jne 0xf02f837
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0f0057d5
leave
ret