Function at 0x1ffcadb0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push ebp
mov edi, dword [esp + 0x20]
test edi, edi
je 0x1ffcaddf
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
cmp eax, 0x8000
je 0x1ffcaddf
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1ffcade1
xor esi, esi
mov eax, dword [esi + 0xf90]
dec eax
cmp eax, 3
ja case.default.0x1ffcadf1
jmp dword [eax*4 + 0x1ffcafc4]
mov eax, dword [esp + 0x1c]
push edi
push 0xf
push 0x600
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
push edi
mov eax, dword [esi + 0xf98]
push eax
mov ecx, dword [esi + 0xf94]
mov edx, dword [esp + 0x24]
push ecx
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esi + 0xf9c]
test eax, eax
je case.default.0x1ffcadf1
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
lea eax, [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push eax
push 0
push 0x1ffe53a8
push Ordinal_2
call edi
test eax, eax
jne 0x1ffcaea0
mov eax, dword [esp + 0x10]
push eax
call sub.LTKRN13N.dll_Ordinal_282
mov ebp, eax
test ebp, ebp
jne 0x1ffcae85
xor ecx, ecx
jmp 0x1ffcaea6
lea eax, [esp + 0x10]
push eax
push ebp
push 0x1ffe53a8
push Ordinal_2
call edi
cmp eax, 1
sbb ecx, ecx
neg ecx
jmp 0x1ffcaea6
xor ecx, ecx
mov ebp, dword [esp + 0x10]
xor eax, eax
test ecx, ecx
je case.default.0x1ffcadf1
mov ebx, dword [esi + 0xf9c]
test ebx, ebx
je 0x1ffcafad
mov esi, ebp
mov dword [esp + 0x10], eax
mov dword [0x1ffe7e30], eax
cmp byte [ebp], al
je 0x1ffcaeff
cmp byte [esi], 0x25
jne 0x1ffcaef3
cmp byte [esi + 1], 0x31
jne 0x1ffcaef3
add esi, 2
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [esp + 0x10], 1
add dword [0x1ffe7e30], eax
jmp 0x1ffcaefa
inc esi
inc dword [0x1ffe7e30]
cmp byte [esi], 0
jne 0x1ffcaece
cmp dword [esp + 0x10], 0
jne 0x1ffcaf14
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add dword [0x1ffe7e30], eax
cmp dword [0x1ffe7e30], 0
jne 0x1ffcaf21
xor eax, eax
jmp 0x1ffcaf90
mov eax, dword [0x1ffe7e30]
inc eax
push eax
call sub.LTKRN13N.dll_Ordinal_282
mov dword [esp + 0x14], eax
test eax, eax
jne 0x1ffcaf39
xor eax, eax
jmp 0x1ffcaf90
mov esi, ebp
mov edi, dword [esp + 0x14]
cmp byte [ebp], 0
je 0x1ffcaf70
mov al, byte [esi]
cmp al, 0x25
jne 0x1ffcaf67
cmp byte [esi + 1], 0x31
jne 0x1ffcaf67
add esi, 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
jmp 0x1ffcaf6b
mov byte [edi], al
inc esi
inc edi
cmp byte [esi], 0
jne 0x1ffcaf45
cmp dword [esp + 0x10], 0
jne 0x1ffcaf8b
push 0x1ffe53a4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, 1
test eax, eax
je 0x1ffcafb6
mov eax, dword [esp + 0x14]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x14]
push ecx
call sub.LTKRN13N.dll_Ordinal_283
jmp 0x1ffcafb6
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_WinExec]
push ebp
call sub.LTKRN13N.dll_Ordinal_283
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret