Function at 0xf01a8f3
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Query or enumerate registry value
Set console window title
Set current directory
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58c
mov eax, dword [0xf062038]
push ebx
xor ebx, ebx
cmp dword [0xf06cb24], ebx
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x4e8], 0x3a3f3d
jne 0xf01a921
call fcn.0f035d25
lea eax, [ebp - 0x4e0]
push eax
xor esi, esi
inc esi
push esi
push ebx
push 0xf0023cc
push 0x80000002
mov dword [ebp - 0x4ec], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf01a999
lea eax, [ebp - 0x4ec]
push eax
lea eax, [ebp - 0x4dc]
push eax
push ebx
push ebx
push 0xf0023c0
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf01a98d
lea eax, [ebp - 0x4dc]
push 0xf0023b8
push eax
call fcn.0f056f70
test eax, eax
pop ecx
pop ecx
je 0xf01a98d
mov dword [0xf06d804], esi
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0xf06cb24], ebx
push edi
mov byte [ebp - 0x1cc], bl
mov edi, 0x104
jne 0xf01aa07
cmp dword [0xf06cb30], ebx
jne 0xf01a9cd
push edi
lea eax, [ebp - 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
test eax, eax
jne 0xf01a9cd
mov byte [ebp - 0x1cc], bl
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x44]
push 0xf0023a4
push eax
call fcn.0f013533
add esp, 0x14
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
jmp 0xf01aa30
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
push dword [eax + 0x10]
lea eax, [ebp - 0x1cc]
push dword [0xf06cb34]
push 0xf002380
push eax
call fcn.0f013533
add esp, 0x10
mov esi, dword [sym.ntvdm.exe_fSeparateWow]
cmp esi, ebx
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x568], eax
mov eax, dword [0xf06cb24]
mov word [ebp - 0x4f8], di
mov dword [ebp - 0x55c], ebx
mov dword [ebp - 0x560], ebx
je 0xf01aa69
mov word [ebp - 0x4f4], 0x900
jmp 0xf01aa7e
xor ecx, ecx
cmp eax, ebx
sete cl
lea ecx, [ecx + ecx + 0x102]
mov word [ebp - 0x4f4], cx
cmp eax, ebx
mov dword [ebp - 0x570], ebx
mov word [ebp - 0x4fc], bx
mov dword [ebp - 0x56c], ebx
mov word [ebp - 0x4fa], bx
je 0xf01aaa6
cmp esi, ebx
mov ecx, dword [0xf06cb34]
je 0xf01aaac
mov ecx, dword [0xf06cb30]
mov dword [ebp - 0x58c], ecx
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffffff7f
add ecx, 0x81
neg eax
sbb eax, eax
mov dword [ebp - 0x500], ecx
not eax
lea ecx, [ebp - 0xc8]
and eax, ecx
cmp byte [ebp - 0x1cc], bl
mov dword [ebp - 0x504], eax
lea eax, [ebp - 0x3dc]
mov dword [ebp - 0x514], ebx
mov dword [ebp - 0x510], ebx
mov word [ebp - 0x4f6], 0x105
mov dword [ebp - 0x564], eax
jne 0xf01ab1b
lea eax, [ebp - 0x1cc]
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0x508], edi
jmp 0xf01ab27
mov dword [ebp - 0x50c], ebx
mov dword [ebp - 0x508], ebx
lea eax, [ebp - 0x58c]
push eax
mov byte [ebp - 0x2d4], bl
mov byte [0xf09c689], bl
mov byte [0xf09c68a], bl
mov byte [0xf09c68b], bl
call sub.KERNEL32.dll_GetNextVDMCommand
test eax, eax
je 0xf01ac13
cmp dword [0xf06cb24], ebx
mov eax, dword [ebp - 0x500]
mov byte [ebp + eax - 0xc8], bl
jne 0xf01abdd
cmp eax, ebx
je 0xf01abdd
lea eax, [ebp - 0xc8]
push 0xf002378
push eax
call fcn.0f056f70
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0xf01abdd
add esi, 6
cmp byte [esi], 0x30
mov eax, esi
jl 0xf01abdd
cmp byte [esi], 0x39
jg 0xf01ab9a
inc esi
cmp byte [esi], 0x30
jge 0xf01ab8f
cmp eax, esi
je 0xf01abdd
mov cl, byte [esi]
push 0xa
push ebx
push eax
mov byte [ebp - 0x4e1], cl
mov byte [esi], bl
call fcn.0f056f15
mov cl, byte [ebp - 0x4e1]
add esp, 0xc
test al, 1
mov byte [esi], cl
je 0xf01abc7
mov byte [0xf09c68a], 1
test al, 2
je 0xf01abd2
mov byte [0xf09c68b], 1
test al, 4
je 0xf01abdd
mov byte [0xf09c689], 1
cmp word [ebp - 0x4f6], bx
je 0xf01ac13
mov al, byte [ebp - 0x3dc]
mov byte [ebp - 0x4e7], al
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0x4e8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x3dc]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [ebp - 0x2d4], bl
mov byte [0xf09c68c], bl
setne al
cmp dword [0xf06cb24], ebx
mov byte [0xf09c68d], bl
mov byte [0xf09c688], al
je 0xf01ac57
mov dword [0xf06cb30], ebx
mov byte [0xf09c68a], 1
mov byte [0xf09c689], 1
mov byte [0xf09c68c], 1
mov byte [0xf09c68b], 1
lea eax, [ebp - 0x2d4]
push eax
call fcn.0f011732
call fcn.0f00eeaa
mov edx, dword [0xf06cb24]
cmp edx, ebx
mov esi, 0x8000
je 0xf01ac89
mov dword [0xf09c65c], ebx
mov dword [0xf0784e0], 0x3c00
jmp 0xf01acd7
mov ax, word [0xf06d7f4]
cmp ax, 0xffff
mov ecx, 0x1000
je 0xf01ac9d
movzx ecx, ax
mov ax, word [0xf06d7f0]
cmp ax, 0xffff
mov dword [0xf09c65c], ecx
jne 0xf01acb6
mov eax, 0x3c00
jmp 0xf01acb9
movzx eax, ax
cmp ecx, esi
mov dword [0xf0784e0], eax
jbe 0xf01acc8
mov dword [0xf09c65c], esi
mov ecx, 0x400
cmp eax, ecx
jae 0xf01acdb
mov dword [0xf0784e0], ecx
cmp edx, ebx
jne 0xf01acff
push ebx
push 9
call fcn.0f010e25
test eax, eax
je 0xf01acff
push 0xf064b1c
call fcn.0f0327d3
test eax, eax
je 0xf01acff
mov dword [0xf064b1c], 1
mov eax, dword [0xf0784e0]
mov ecx, dword [0xf09c65c]
lea eax, [eax + ecx + 0x400]
shl eax, 0xa
push eax
call fcn.0f00eb2c
call fcn.0f00e71f
cmp dword [0xf06d804], ebx
je 0xf01ad9b
push 0x40
mov edi, 0x3000
push edi
lea eax, [ebp - 0x4ec]
push eax
push ebx
lea eax, [ebp - 0x4e0]
push eax
mov dword [ebp - 0x4ec], esi
mov esi, dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
push 0xffffffffffffffff
mov dword [ebp - 0x4e0], 0xc0000
call esi
test eax, eax
jge 0xf01ad61
call fcn.0f034e04
push 0x40
push edi
lea eax, [ebp - 0x4ec]
push eax
push ebx
lea eax, [ebp - 0x4e0]
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x4e0], 0xf0000
mov dword [ebp - 0x4ec], 0x10000
call esi
test eax, eax
jge 0xf01ad94
call fcn.0f034e04
call fcn.0f059aa4
jmp 0xf01ada0
call fcn.0f0120cf
cmp dword [0xf06cb24], ebx
pop edi
jne 0xf01ade5
push 6
pop esi
lea eax, [ebp - 0x44]
push eax
push 0xf002364
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
mov dword [0xf09c114], eax
jne 0xf01ade5
cmp esi, ebx
je 0xf01add8
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0xf09c114], ebx
jne 0xf01ade5
mov eax, esi
dec esi
test eax, eax
jne 0xf01adac
mov dword [0xf09c114], ebx
cmp byte [ebp - 0x1cc], bl
je 0xf01adfa
lea eax, [ebp - 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.0f014316
call fcn.0f00a085
push 2
mov byte [0xf06d7fc], bl
mov byte [ebp - 0x4e0], 0x33
pop esi
push ebx
push 1
push dword [ebp - 0x4e0]
call fcn.0f00e501
test ax, ax
jne 0xf01ae2d
inc byte [0xf06d7fc]
inc byte [ebp - 0x4e0]
dec esi
jne 0xf01ae14
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0f01b9b9
leave
ret