Function at 0xf01a78f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Query or enumerate registry value
Set console window title
Set current directory
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58c
mov eax, dword [0xf061038]
push ebx
xor ebx, ebx
cmp dword [0xf06bb24], ebx
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x4e8], 0x3a3f3d
jne 0xf01a7bd
call fcn.0f035b28
lea eax, [ebp - 0x4e0]
push eax
xor esi, esi
inc esi
push esi
push ebx
push 0xf0023ac
push 0x80000002
mov dword [ebp - 0x4ec], 0x100
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf01a835
lea eax, [ebp - 0x4ec]
push eax
lea eax, [ebp - 0x4dc]
push eax
push ebx
push ebx
push 0xf0023a0
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf01a829
lea eax, [ebp - 0x4dc]
push 0xf002398
push eax
call fcn.0f056c70
test eax, eax
pop ecx
pop ecx
je 0xf01a829
mov dword [0xf06c804], esi
push dword [ebp - 0x4e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0xf06bb24], ebx
push edi
mov byte [ebp - 0x1cc], bl
mov edi, 0x104
jne 0xf01a8a3
cmp dword [0xf06bb30], ebx
jne 0xf01a869
push edi
lea eax, [ebp - 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
test eax, eax
jne 0xf01a869
mov byte [ebp - 0x1cc], bl
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x44]
push 0xf002384
push eax
call fcn.0f01347c
add esp, 0x14
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
jmp 0xf01a8cc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
push dword [eax + 0x10]
lea eax, [ebp - 0x1cc]
push dword [0xf06bb34]
push 0xf002360
push eax
call fcn.0f01347c
add esp, 0x10
mov esi, dword [sym.ntvdm.exe_fSeparateWow]
cmp esi, ebx
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x568], eax
mov eax, dword [0xf06bb24]
mov word [ebp - 0x4f8], di
mov dword [ebp - 0x55c], ebx
mov dword [ebp - 0x560], ebx
je 0xf01a905
mov word [ebp - 0x4f4], 0x900
jmp 0xf01a91a
xor ecx, ecx
cmp eax, ebx
sete cl
lea ecx, [ecx + ecx + 0x102]
mov word [ebp - 0x4f4], cx
cmp eax, ebx
mov dword [ebp - 0x570], ebx
mov word [ebp - 0x4fc], bx
mov dword [ebp - 0x56c], ebx
mov word [ebp - 0x4fa], bx
je 0xf01a942
cmp esi, ebx
mov ecx, dword [0xf06bb34]
je 0xf01a948
mov ecx, dword [0xf06bb30]
mov dword [ebp - 0x58c], ecx
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffffff7f
add ecx, 0x81
neg eax
sbb eax, eax
mov dword [ebp - 0x500], ecx
not eax
lea ecx, [ebp - 0xc8]
and eax, ecx
cmp byte [ebp - 0x1cc], bl
mov dword [ebp - 0x504], eax
lea eax, [ebp - 0x3dc]
mov dword [ebp - 0x514], ebx
mov dword [ebp - 0x510], ebx
mov word [ebp - 0x4f6], 0x105
mov dword [ebp - 0x564], eax
jne 0xf01a9b7
lea eax, [ebp - 0x1cc]
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0x508], edi
jmp 0xf01a9c3
mov dword [ebp - 0x50c], ebx
mov dword [ebp - 0x508], ebx
lea eax, [ebp - 0x58c]
push eax
mov byte [ebp - 0x2d4], bl
mov byte [0xf09b649], bl
mov byte [0xf09b64a], bl
mov byte [0xf09b64b], bl
call sub.KERNEL32.dll_GetNextVDMCommand
test eax, eax
je 0xf01aaaf
cmp dword [0xf06bb24], ebx
mov eax, dword [ebp - 0x500]
mov byte [ebp + eax - 0xc8], bl
jne 0xf01aa79
cmp eax, ebx
je 0xf01aa79
lea eax, [ebp - 0xc8]
push 0xf002358
push eax
call fcn.0f056c70
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0xf01aa79
add esi, 6
cmp byte [esi], 0x30
mov eax, esi
jl 0xf01aa79
cmp byte [esi], 0x39
jg 0xf01aa36
inc esi
cmp byte [esi], 0x30
jge 0xf01aa2b
cmp eax, esi
je 0xf01aa79
mov cl, byte [esi]
push 0xa
push ebx
push eax
mov byte [ebp - 0x4e1], cl
mov byte [esi], bl
call fcn.0f056c15
mov cl, byte [ebp - 0x4e1]
add esp, 0xc
test al, 1
mov byte [esi], cl
je 0xf01aa63
mov byte [0xf09b64a], 1
test al, 2
je 0xf01aa6e
mov byte [0xf09b64b], 1
test al, 4
je 0xf01aa79
mov byte [0xf09b649], 1
cmp word [ebp - 0x4f6], bx
je 0xf01aaaf
mov al, byte [ebp - 0x3dc]
mov byte [ebp - 0x4e7], al
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0x4e8]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea eax, [ebp - 0x3dc]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp byte [ebp - 0x2d4], bl
mov byte [0xf09b64c], bl
setne al
cmp dword [0xf06bb24], ebx
mov byte [0xf09b64d], bl
mov byte [0xf09b648], al
je 0xf01aaf3
mov dword [0xf06bb30], ebx
mov byte [0xf09b64a], 1
mov byte [0xf09b649], 1
mov byte [0xf09b64c], 1
mov byte [0xf09b64b], 1
lea eax, [ebp - 0x2d4]
push eax
call fcn.0f01167b
call fcn.0f00edf3
mov edx, dword [0xf06bb24]
cmp edx, ebx
mov esi, 0x8000
je 0xf01ab25
mov dword [0xf09b61c], ebx
mov dword [0xf0774a0], 0x3c00
jmp 0xf01ab73
mov ax, word [0xf06c7f4]
cmp ax, 0xffff
mov ecx, 0x1000
je 0xf01ab39
movzx ecx, ax
mov ax, word [0xf06c7f0]
cmp ax, 0xffff
mov dword [0xf09b61c], ecx
jne 0xf01ab52
mov eax, 0x3c00
jmp 0xf01ab55
movzx eax, ax
cmp ecx, esi
mov dword [0xf0774a0], eax
jbe 0xf01ab64
mov dword [0xf09b61c], esi
mov ecx, 0x400
cmp eax, ecx
jae 0xf01ab77
mov dword [0xf0774a0], ecx
cmp edx, ebx
jne 0xf01ab9b
push ebx
push 9
call fcn.0f010d6e
test eax, eax
je 0xf01ab9b
push 0xf063b14
call fcn.0f0325b1
test eax, eax
je 0xf01ab9b
mov dword [0xf063b14], 1
mov eax, dword [0xf0774a0]
mov ecx, dword [0xf09b61c]
lea eax, [eax + ecx + 0x400]
shl eax, 0xa
push eax
call fcn.0f00ea75
call fcn.0f00e668
cmp dword [0xf06c804], ebx
je 0xf01ac37
push 0x40
mov edi, 0x3000
push edi
lea eax, [ebp - 0x4ec]
push eax
push ebx
lea eax, [ebp - 0x4e0]
push eax
mov dword [ebp - 0x4ec], esi
mov esi, dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
push 0xffffffffffffffff
mov dword [ebp - 0x4e0], 0xc0000
call esi
test eax, eax
jge 0xf01abfd
call fcn.0f034c11
push 0x40
push edi
lea eax, [ebp - 0x4ec]
push eax
push ebx
lea eax, [ebp - 0x4e0]
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x4e0], 0xf0000
mov dword [ebp - 0x4ec], 0x10000
call esi
test eax, eax
jge 0xf01ac30
call fcn.0f034c11
call fcn.0f0597a4
jmp 0xf01ac3c
call fcn.0f012018
cmp dword [0xf06bb24], ebx
pop edi
jne 0xf01ac81
push 6
pop esi
lea eax, [ebp - 0x44]
push eax
push 0xf002344
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
mov dword [0xf09b0d4], eax
jne 0xf01ac81
cmp esi, ebx
je 0xf01ac74
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0xf09b0d4], ebx
jne 0xf01ac81
mov eax, esi
dec esi
test eax, eax
jne 0xf01ac48
mov dword [0xf09b0d4], ebx
cmp byte [ebp - 0x1cc], bl
je 0xf01ac96
lea eax, [ebp - 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.0f01425f
call fcn.0f009fdd
push 2
mov byte [0xf06c7fc], bl
mov byte [ebp - 0x4e0], 0x33
pop esi
push ebx
push 1
push dword [ebp - 0x4e0]
call fcn.0f00e44a
test ax, ax
jne 0xf01acc9
inc byte [0xf06c7fc]
inc byte [ebp - 0x4e0]
dec esi
jne 0xf01acb0
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0f01b780
leave
ret