Function at 0x1009d45
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3d0]
push eax
call esi
test eax, eax
je 0x1009ea5
lea eax, [ebp - 0x3d0]
push eax
call fcn.01001afa
test eax, eax
jne 0x10016a8
lea eax, [ebp - 0x3d0]
push eax
push dword [0x101e0a8]
push dword [0x101e098]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x10016a8
lea eax, [ebp - 0x3d0]
push eax
push dword [0x101e098]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x10016a8
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x10016a8
cmp eax, esi
je 0x1009ea5
push 0x101e474
push 0x101e46c
push 0x101e468
call fcn.0100629d
cmp dword [0x101e468], ebx
je 0x10052a8
push 0x101e478
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea eax, [ebp - 0x3a8]
push eax
push 0x20019
push ebx
push 0x10052e0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1009e12
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.01008410
jmp 0x1009f29
call fcn.0100603d
call fcn.010064ac
test al, al
je 0x10081fd
push ebx
push 0x10015e5
push ebx
push 0x69
push dword [ebp - 0x3b4]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov dword [0x101e098], eax
cmp eax, ebx
jne 0x100a07a
jmp 0x10081fd
mov eax, dword [0x101e14c]
mov ecx, dword [0x101e154]
mov edx, dword [0x101e150]
push 4
sub ecx, eax
push ecx
mov ecx, dword [0x101e148]
sub edx, ecx
push edx
push eax
push ecx
push ebx
push dword [0x101e098]
mov dword [0x101f804], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [ebp + 0x14]
push dword [0x101e098]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x101e098]
call fcn.01005e3d
mov eax, dword [0x101e094]
cmp eax, ebx
je 0x1005e25
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x10016a8
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov dword [0x101e0a4], edi
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push 0x1006464
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push esi
mov dword [0x101f6b8], eax
call fcn.0100de95
jmp 0x1009e05
cmp dword [0x101e468], ebx
je 0x100821a
cmp dword [0x101e46c], ebx
jne 0x100821a
push 0x50
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
je 0x100a057
mov ecx, eax
call fcn.010063c5
jmp 0x100a059
mov ecx, eax
call fcn.01006335
jmp 0x1009fdf
mov dword [ebp - 0x3a0], ebx
jmp 0x1009ea5
mov eax, dword [0x101fdc8]
cmp eax, ebx
jne 0x1009f0e
jmp 0x1008f7d
dec dword [0x101e0d8]
jmp 0x100545c
push ebx
push ebx
push esi
push ebx
mov dword [0x101fac8], eax
mov dword [0x101facc], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x101e0b0
push ebx
mov edi, eax
push edi
push 0x10017d5
push ebx
push ebx
mov dword [ebp - 0x3a4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x101e0b4], eax
cmp edi, ebx
je 0x100826b
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x4c
mov dword [0x101e0d8], 6
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
je 0x1009fbb
mov ecx, eax
call fcn.01006385
jmp 0x1009fbd
call fcn.01007ef5
test al, al
jne 0x100a06b
push 0x8c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
jne 0x100a018
jmp 0x100a021
mov ecx, eax
call fcn.0100b3e5
jmp 0x100a045
mov ecx, dword [0x101e548]
cmp ecx, ebx
je 0x1008f17
mov eax, dword [ecx]
push 1
call dword [eax + 0x1c]
mov ecx, dword [0x101e54c]
cmp ecx, ebx
je 0x1008f28
mov eax, dword [ecx]
push 1
call dword [eax + 0x1c]
mov ecx, dword [0x101e550]
cmp ecx, ebx
je 0x1008f39
mov eax, dword [ecx]
push 1
call dword [eax + 0x1c]
mov ecx, dword [0x101e554]
cmp ecx, ebx
je 0x1008f4a
mov eax, dword [ecx]
push 1
call dword [eax + 0x1c]
mov ecx, dword [0x101e558]
cmp ecx, ebx
je 0x1008f5b
push 1
call fcn.01008fb5
mov ecx, dword [0x101e55c]
cmp ecx, ebx
je 0x1008f6c
mov eax, dword [ecx]
push 1
call dword [eax + 0x1c]
cmp dword [ebp - 0x3a4], ebx
jne 0x1009f01
jmp 0x1008208
cmp dword [0x101f820], ebx
pop edi
pop esi
pop ebx
je 0x1009f1a
push 0x101f808
call dword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
jmp 0x1009f1a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x3a0]
xor ecx, ebp
call fcn.01001679
leave
ret 0x10
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3d4
mov eax, dword [0x101e08c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x101fd80
push 0x101fd88
xor esi, esi
push 0x100dc9f
xor ebx, ebx
inc esi
push 0x100a090
mov dword [ebp - 0x3b4], edi
mov dword [ebp - 0x3a0], esi
mov dword [ebp - 0x3ac], ebx
mov dword [ebp - 0x3a4], ebx
call fcn.0100dcf6
cmp dword [0x101fdac], ebx
je 0x1006421
mov al, byte [0x101fdb0]
cmp al, 4
jae 0x1009db3
cmp al, bl
jne 0x1006421
mov ecx, dword [0x101fd9c]
mov edx, 0x80010000
and ecx, edx
xor eax, eax
or eax, ecx
je 0x1006421
mov ecx, dword [0x101fda4]
mov eax, ecx
and eax, edx
xor edx, edx
cmp edx, dword [0x101fda0]
jne 0x1006421
cmp eax, ecx
jne 0x1006421
push 0x100a0a0
push dword [0x101fd84]
push dword [0x101fd80]
call fcn.0100dd53
jmp 0x1006421
cmp eax, ebx
jge 0x1005272
jmp 0x1009ea5
lea eax, [ebp - 0x3b0]
push eax
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x3d4]
push eax
push ebx
push 0x100a0b0
push dword [ebp - 0x3a8]
mov dword [ebp - 0x3b0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x3a8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x3ac], ebx
je 0x10052cd
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea eax, [ebp - 0x39c]
push eax
push 0x2729
push edi
call esi
push 0xc8
lea eax, [ebp - 0x194]
push eax
push 0x272a
push edi
call esi
push 0x10
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x194]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x10081fd
mov eax, dword [0x101e094]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
cmp eax, ebx
je 0x1009ed4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x101e094]
cmp eax, ebx
je 0x1009ed4
cmp eax, esi
je 0x1009ed4
push eax
call edi
mov dword [0x101e094], esi
mov eax, dword [0x101fdb8]
test eax, eax
je 0x1008f06
mov eax, dword [0x101fdb8]
cmp eax, esi
je 0x1008f06
push dword [0x101fdb8]
call edi
mov dword [0x101fdb8], esi
jmp 0x1008f06
push dword [ebp - 0x3a4]
call edi
jmp 0x1008208
push eax
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
jmp 0x1008f7d
push 0x101fd80
call fcn.0100dd22
jmp 0x1008f9c
call fcn.0100da9d
call dword [sym.imp.KERNEL32.dll_GetErrorMode]
or eax, 0x8001
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x101f808
call dword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
test eax, eax
jl 0x10081fd
mov dword [0x101f820], esi
mov dword [0x101fac0], 3
mov dword [0x101fac8], ebx
mov dword [0x101facc], ebx
mov dword [0x101fad0], ebx
mov dword [0x101fad4], ebx
mov dword [0x101fad8], ebx
mov dword [0x101fadc], ebx
mov dword [0x101fae0], esi
mov dword [0x101fae4], 0x28
mov dword [0x101fdc4], esi
mov dword [0x101fac4], ebx
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
mov dword [0x101fdc8], eax
cmp eax, ebx
jne 0x1008225
jmp 0x10081fd
xor eax, eax
mov dword [0x101e548], eax
cmp eax, ebx
je 0x10081fd
push 0x27c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
jne 0x10081f1
xor eax, eax
mov dword [0x101e54c], eax
cmp eax, ebx
je 0x10081fd
push 0x3290
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
je 0x100a004
mov ecx, eax
call fcn.0100e0b5
jmp 0x100a006
xor eax, eax
mov dword [0x101e550], eax
cmp eax, ebx
jne 0x1008291
jmp 0x10081fd
mov ecx, eax
call fcn.010102b1
jmp 0x100a023
xor eax, eax
mov dword [0x101e554], eax
cmp eax, ebx
je 0x10081fd
push 0x80
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
jne 0x10082b6
xor eax, eax
mov dword [0x101e558], eax
cmp eax, ebx
jne 0x10081c5
jmp 0x10081fd
xor eax, eax
mov dword [0x101e55c], eax
cmp eax, ebx
je 0x10081fd
jmp 0x100545c
mov dword [0x101e0d8], 3
jmp 0x100545c
push ebx
push esi
push 0x40b
push eax
call dword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
jmp 0x1005dc7