Function at 0x1007cd10
Capabilities:
Allocate or change rwx memory
Delete registry key
Execute shellcode via indirect call
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x278
mov eax, dword [0x100e50d4]
xor eax, esp
mov dword [esp + 0x274], eax
mov al, byte [ebp + 8]
mov byte [esp + 7], 1
mov byte [0x100f24fa], al
push esi
push edi
test al, al
je 0x1007d6f2
cmp byte [0x100f25ac], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jne 0x1007d552
mov al, byte [ebp + 0xc]
mov esi, dword [0x100f2708]
mov byte [0x100f25ac], 1
mov byte [0x100f24fb], al
mov byte [esp + 0x10], 0
test esi, esi
jle 0x1007cd76
mov esi, dword [esi]
jmp 0x1007cd78
xor esi, esi
mov ecx, dword [esi + 0x3d0]
mov eax, dword [esi + 0x3cc]
mov edi, dword [esi + 0x3bc]
mov edx, dword [esi + 0x428]
add edi, 0xb4
mov dword [esp + 0x5c], eax
mov eax, dword [esi + 0x3dc]
mov dword [esp + 0x6c], eax
mov eax, dword [esi + 0x3e0]
mov dword [esp + 0x64], eax
mov eax, dword [ecx + 0x138]
mov dword [esp + 0x60], eax
mov dword [0x100f2584], eax
mov eax, dword [ecx + 0x130]
mov dword [0x100f2588], eax
mov eax, dword [ecx + 0x134]
mov dword [0x100f258c], eax
mov eax, dword [ecx + 0x160]
lea ecx, [esp + 0x10]
mov dword [esp + 0x58], esi
mov dword [0x100f2590], eax
call fcn.10054d20
mov ecx, dword [0x10106ff0]
add esi, 0xb4
xorps xmm0, xmm0
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
movss dword [esp + 0x68], xmm0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xc1200000
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
cmp dword [0x10106ff4], ecx
je 0x1007ce8a
movups xmm0, xmmword [esp + 0x10]
mov eax, dword [esp + 0x40]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [esp + 0x20]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [ecx + 0x20], xmm0
mov dword [ecx + 0x30], eax
mov edx, dword [0x10106ff0]
add edx, 0x34
mov dword [0x10106ff0], edx
jmp 0x1007ce9b
lea eax, [esp + 0x10]
push eax
push ecx
call fcn.10087480
mov edx, dword [0x10106ff0]
lea ecx, [esp + 0x10]
call fcn.10054d20
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 2
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x3f800000
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 2
mov dword [esp + 0x38], 2
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
cmp dword [0x10106ff4], edx
je 0x1007cf32
movups xmm0, xmmword [esp + 0x10]
mov eax, dword [esp + 0x40]
movups xmmword [edx], xmm0
movups xmm0, xmmword [esp + 0x20]
movups xmmword [edx + 0x10], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [edx + 0x20], xmm0
mov dword [edx + 0x30], eax
mov edx, dword [0x10106ff0]
add edx, 0x34
mov dword [0x10106ff0], edx
jmp 0x1007cf43
lea eax, [esp + 0x10]
push eax
push edx
call fcn.10087480
mov edx, dword [0x10106ff0]
lea ecx, [esp + 0x10]
call fcn.10054d20
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 6
mov dword [esp + 0x20], 6
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x3e051eb8
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 6
mov dword [esp + 0x38], 6
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0x3e051eb8
cmp dword [0x10106ff4], edx
je 0x1007cfd6
movups xmm0, xmmword [esp + 0x10]
mov eax, dword [esp + 0x40]
movups xmmword [edx], xmm0
movups xmm0, xmmword [esp + 0x20]
movups xmmword [edx + 0x10], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [edx + 0x20], xmm0
mov dword [edx + 0x30], eax
mov edx, dword [0x10106ff0]
add edx, 0x34
mov dword [0x10106ff0], edx
jmp 0x1007cfe7
lea eax, [esp + 0x10]
push eax
push edx
call fcn.10087480
mov edx, dword [0x10106ff0]
lea ecx, [esp + 0x10]
call fcn.10054d20
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 2
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 2
mov dword [esp + 0x38], 2
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0xbca3d70a
cmp dword [0x10106ff4], edx
je 0x1007d07a
movups xmm0, xmmword [esp + 0x10]
mov eax, dword [esp + 0x40]
movups xmmword [edx], xmm0
movups xmm0, xmmword [esp + 0x20]
movups xmmword [edx + 0x10], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [edx + 0x20], xmm0
mov dword [edx + 0x30], eax
mov edx, dword [0x10106ff0]
add edx, 0x34
mov dword [0x10106ff0], edx
jmp 0x1007d08b
lea eax, [esp + 0x10]
push eax
push edx
call fcn.10087480
mov edx, dword [0x10106ff0]
lea ecx, [esp + 0x10]
call fcn.10054d20
mov eax, dword [esp + 0x60]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x41200000
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
cmp dword [0x10106ff4], edx
je 0x1007d122
movups xmm0, xmmword [esp + 0x10]
mov eax, dword [esp + 0x40]
movups xmmword [edx], xmm0
movups xmm0, xmmword [esp + 0x20]
movups xmmword [edx + 0x10], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [edx + 0x20], xmm0
mov dword [edx + 0x30], eax
mov edx, dword [0x10106ff0]
add edx, 0x34
mov dword [0x10106ff0], edx
jmp 0x1007d133
lea eax, [esp + 0x10]
push eax
push edx
call fcn.10087480
mov edx, dword [0x10106ff0]
lea ecx, [esp + 0x10]
call fcn.10054d20
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x3ecccccd
mov dword [esp + 0x28], 0x3e99999a
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0x3b75c28f
mov dword [esp + 0x40], 0xbcd70a3d
cmp dword [0x10106ff4], edx
je 0x1007d1ca
movups xmm0, xmmword [esp + 0x10]
mov eax, dword [esp + 0x40]
movups xmmword [edx], xmm0
movups xmm0, xmmword [esp + 0x20]
movups xmmword [edx + 0x10], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [edx + 0x20], xmm0
mov dword [edx + 0x30], eax
mov edi, dword [0x10106ff0]
add edi, 0x34
mov dword [0x10106ff0], edi
jmp 0x1007d1db
lea eax, [esp + 0x10]
push eax
push edx
call fcn.10087480
mov edi, dword [0x10106ff0]
mov ecx, edi
mov eax, 0x4ec4ec4f
sub ecx, dword [0x10106fec]
imul ecx
lea ecx, [esp + 0x10]
sar edx, 4
mov eax, edx
shr eax, 0x1f
dec eax
add eax, edx
mov dword [0x100f255c], eax
call fcn.10054d20
mov eax, dword [esp + 0x64]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 6
mov dword [esp + 0x20], 6
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xc1200000
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 6
mov dword [esp + 0x38], 6
mov dword [esp + 0x3c], 0x3b75c28f
mov dword [esp + 0x40], 0x3e2e147b
cmp dword [0x10106ff4], edi
je 0x1007d291
movups xmm0, xmmword [esp + 0x10]
mov eax, dword [esp + 0x40]
movups xmmword [edi], xmm0
movups xmm0, xmmword [esp + 0x20]
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [edi + 0x20], xmm0
mov dword [edi + 0x30], eax
mov edx, dword [0x10106ff0]
add edx, 0x34
mov dword [0x10106ff0], edx
jmp 0x1007d2a2
lea eax, [esp + 0x10]
push eax
push edi
call fcn.10087480
mov edx, dword [0x10106ff0]
mov esi, dword [0x100f255c]
lea eax, [esi + 1]
mov dword [0x100f2558], eax
mov eax, dword [esp + 0x58]
mov edi, dword [eax + 0x1cc]
test edi, edi
jle 0x1007d36c
lea ecx, [esp + 0x10]
call fcn.10054d20
mov eax, dword [eax + 0x428]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], 8
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x3e3ced91
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 8
mov dword [esp + 0x38], 8
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0x3e266666
cmp dword [0x10106ff4], edx
je 0x1007d353
movups xmm0, xmmword [esp + 0x10]
mov eax, dword [esp + 0x40]
movups xmmword [edx], xmm0
movups xmm0, xmmword [esp + 0x20]
movups xmmword [edx + 0x10], xmm0
movups xmm0, xmmword [esp + 0x30]
movups xmmword [edx + 0x20], xmm0
mov dword [edx + 0x30], eax
add dword [0x10106ff0], 0x34
jmp 0x1007d364
lea eax, [esp + 0x10]
push eax
push edx
call fcn.10087480
mov esi, dword [0x100f255c]
lea eax, [esi + 1]
mov dword [0x100f2558], eax
mov eax, dword [0x100f2748]
mov ecx, 0x100f27f4
add eax, 0xf530
call eax
mov dword [0x100f27f0], eax
test eax, eax
je 0x1007d390
movss xmm0, dword [eax]
movss dword [esp + 0x68], xmm0
movss xmm0, dword [0x100daae4]
lea ecx, [esp + 0x6c]
divss xmm0, dword [esp + 0x68]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ecx
push 0xf003f
push 0
mov dword [0x100f256c], 0x42300000
mov dword [0x100f2568], 0x42300000
movss xmm1, dword [0x100daac0]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x100da890]
cvtpd2ps xmm2, xmm0
movaps xmm0, xmm2
mulss xmm2, dword [0x100daaf8]
mulss xmm0, dword [0x100daafc]
movss dword [0x100f2548], xmm2
cvttss2si eax, xmm0
mov dword [0x100f2554], eax
add eax, eax
cmp dword [0x100ef09c], 0x10
mov dword [0x100f2544], eax
movd xmm0, eax
mov eax, 0x100ef088
cvtdq2ps xmm0, xmm0
cmovae eax, dword [0x100ef088]
push eax
push closesocket
divss xmm1, xmm0
movss dword [0x100f254c], xmm1
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1007d473
lea eax, [esp + 0x64]
mov dword [esp + 0x64], 0x104
push eax
lea eax, [esp + 0x74]
push eax
push 0
push 0
push str.KENGAROO
push dword [esp + 0x80]
call esi
cmp eax, 2
je 0x1007d473
cmp dword [esp + 0x70], 7
sete byte [esp + 0xf]
jmp 0x1007d478
mov byte [esp + 0xf], 0
mov ecx, 0x10103fe0
call fcn.10069b90
xor cl, cl
call fcn.1006d700
cmp byte [esp + 0xf], 0
mov byte [0x100f25a3], al
jne 0x1007d4d0
lea eax, [esp + 0x68]
push eax
push 0xf003f
push 0
push str.Software_
push closesocket
call edi
push str.WarCraftHelper
push dword [esp + 0x6c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push dword [esp + 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop word [eax + eax]
cmp dword [0x100ef09c], 0x10
lea ecx, [esp + 0x68]
push ecx
push 0xf003f
mov eax, 0x100ef088
cmovae eax, dword [0x100ef088]
push 0
push eax
push closesocket
call edi
test eax, eax
jne 0x1007d54b
lea eax, [esp + 0x64]
mov dword [esp + 0x64], 0x104
push eax
lea eax, [esp + 0x74]
push eax
push 0
push 0
push str.ASIDE
push dword [esp + 0x7c]
call esi
cmp eax, 2
jne 0x1007d6e9
push 4
lea eax, [esp + 0x70]
mov dword [esp + 0x70], 0
push eax
push 4
push 0
push str.ASIDE
push dword [esp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1007d4d0
xor eax, eax
mov dword [0x100f2524], eax
mov eax, dword [0x10106fec]
xor ecx, ecx
mov dword [esp + 0x58], ecx
mov ecx, dword [0x10106ff0]
mov dword [esp + 0x64], eax
sub ecx, eax
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1007d5f6
mov edi, dword [esp + 0x64]
xor esi, esi
mov eax, dword [0x100f2748]
mov byte [esi + edi], 1
add eax, 0x606770
mov ecx, dword [0x10106fec]
push 1
sub esp, 8
movss xmm0, dword [esi + ecx + 0x18]
movss dword [esp + 4], xmm0
movss xmm0, dword [esi + ecx + 0x14]
movss dword [esp], xmm0
push dword [esi + ecx + 0x10]
push dword [esi + ecx + 8]
push dword [esi + ecx + 0xc]
mov ecx, dword [esi + ecx + 4]
call eax
mov ecx, dword [0x10106ff0]
lea esi, [esi + 0x34]
mov edi, dword [0x10106fec]
mov eax, 0x4ec4ec4f
inc dword [esp + 0x58]
sub ecx, edi
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x58], eax
jb 0x1007d582
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp byte [0x100f25a3], 0
je 0x1007d664
cmp byte [esp + 0xf], 0
jne 0x1007d656
mov cl, 1
call fcn.1006d700
cmp dword [0x100ef09c], 0x10
lea ecx, [esp + 0x64]
push ecx
mov byte [0x100f25a3], al
mov eax, 0x100ef088
cmovae eax, dword [0x100ef088]
push 0xf003f
push 0
push eax
push closesocket
call edi
test eax, eax
jne 0x1007d656
push 4
push 0x100d6574
push 4
push eax
push str.KENGAROO
push dword [esp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp byte [0x100f25a3], 0
je 0x1007d664
call fcn.1007e250
mov edx, 2
mov cl, 1
call fcn.10080720
mov edx, 0x10
mov cl, 1
call fcn.10080720
cmp byte [0x10103fe0], 0
je 0x1007d691
push 1
mov ecx, 0x10103fe0
call fcn.1006b340
mov edi, dword [0x100f2748]
lea eax, [esp + 0x68]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add edi, 0x941548
push eax
push 0x40
push 4
push edi
call esi
lea eax, [esp + 0x68]
mov dword [edi], 0x3f19999a
push eax
push dword [esp + 0x6c]
push 4
push edi
call esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
pop esi
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.10097f9e
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esp + 0x70]
jmp 0x1007d54d
mov edi, dword [0x100f2748]
lea eax, [esp + 0x68]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add edi, 0x941548
push eax
push 0x40
push 4
push edi
call esi
lea eax, [esp + 0x68]
mov dword [edi], 0x3f147ae1
push eax
push dword [esp + 0x6c]
push 4
push edi
call esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edi, dword [0x10106fec]
xor ecx, ecx
mov dword [esp + 0x58], ecx
mov eax, 0x4ec4ec4f
mov ecx, dword [0x10106ff0]
sub ecx, edi
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1007d7d0
xor esi, esi
nop dword [eax]
mov eax, dword [0x100f2748]
mov byte [esi + edi], 0
add eax, 0x606770
mov ecx, dword [0x10106fec]
push 1
sub esp, 8
movss xmm0, dword [esi + ecx + 0x30]
movss dword [esp + 4], xmm0
movss xmm0, dword [esi + ecx + 0x2c]
movss dword [esp], xmm0
push dword [esi + ecx + 0x28]
push dword [esi + ecx + 0x20]
push dword [esi + ecx + 0x24]
mov ecx, dword [esi + ecx + 0x1c]
call eax
mov ecx, dword [0x10106ff0]
lea esi, [esi + 0x34]
mov edi, dword [0x10106fec]
mov eax, 0x4ec4ec4f
inc dword [esp + 0x58]
sub ecx, edi
imul ecx
mov ecx, dword [esp + 0x58]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jb 0x1007d760
xor edx, edx
xor cl, cl
call fcn.10080720
cmp byte [0x10103fe0], 0
je 0x1007d7ee
push 0
mov ecx, 0x10103fe0
call fcn.1006b340
mov ecx, dword [esp + 0x27c]
pop edi
pop esi
xor ecx, esp
call fcn.10097f9e
mov esp, ebp
pop ebp
ret 8