Function at 0x10010c4
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
into
and al, byte [eax]
add dl, ch
ljmp 0x23
add byte [edx], bl
and eax, dword [eax]
add byte [esi], ah
and eax, dword [eax]
add byte [edx], bh
and eax, dword [eax]
add byte [edx + 0x23], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
bound esp, qword [ebx]
add byte [eax], al
jo 0x10010b9
add byte [eax], al
jle 0x10010bd
add byte [eax], al
mov ah, byte [ebx]
add byte [eax], al
mov al, byte [0xb0000023]
and eax, dword [eax]
add byte [ebx + 0x23d00000], bh
add byte [eax], al
in al, dx
and eax, dword [eax]
add dh, bh
and eax, dword [eax]
add byte [edx], cl
and al, 0
add byte [eax], bl
and al, 0
add byte [eax], al
add byte [eax], al
add byte [ebx - 0x1374aa01], cl
sub esp, 0xac
push ebx
xor ebx, ebx
push esi
push ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x40], ebx
call dword [0x1001060]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call dword [0x100105c]
mov esi, eax
push 0x10013dc
push esi
mov dword [ebp - 4], esi
call fcn.01001590
pop ecx
test eax, eax
pop ecx
setne byte [ebp - 6]
call fcn.01001479
test al, al
jne 0x10017d1
push 1
call dword [0x1001080]
push eax
call dword [0x1001048]
call dword [0x1001044]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x100181a
push edi
call dword [0x1001040]
test eax, eax
mov edi, dword [0x100103c]
jl 0x100181e
call dword [0x1001030]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xac]
push eax
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0xac], 0x44
call dword [0x100102c]
push 0x1001340
xor esi, esi
inc esi
push esi
push ebx
call dword [0x1001028]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x10018d8
call dword [0x1001084]
cmp eax, 0xb7
je 0x1001896
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push 0x1001378
push 0x80000002
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100123d
mov esi, dword [entry0]
lea eax, [ebp - 0x28]
push eax
push ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0x10013bc
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x1001231
cmp dword [ebp - 0x2c], 1
jne 0x1001231
push dword [ebp - 0x28]
push ebx
push dword [ebp - 0x18]
call dword [0x1001038]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x1001231
lea ecx, [ebp - 0x28]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0x10013bc
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x1001224
push dword [ebp - 0xc]
call dword [0x1001020]
push dword [ebp - 0xc]
push ebx
push dword [ebp - 0x18]
call dword [0x100101c]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], ebx
push dword [ebp - 4]
call fcn.010015eb
test al, al
jne 0x10018e3
push 0x10013d4
mov byte [ebp - 5], bl
call dword [0x1001054]
mov edi, eax
cmp edi, ebx
je 0x100179c
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov esi, dword [0x1001018]
push 0xbb8
push edi
call esi
push 0xbb9
push edi
mov dword [ebp - 4], eax
call esi
push 0x10013c4
push edi
mov dword [ebp - 0xc], eax
call esi
cmp dword [ebp - 4], ebx
mov esi, eax
je 0x10012e9
cmp dword [ebp - 0xc], ebx
je 0x10012e9
cmp esi, ebx
je 0x10012f3
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [ebp - 0xc]
test eax, eax
jne 0x10012e9
push 0x8001
call dword [0x1001014]
test byte [ebp - 0x80], 1
jne 0x1001785
push 0xa
pop eax
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x44]
call dword [ebp - 4]
cmp eax, 0x80070005
mov dword [ebp - 0x40], eax
setne byte [ebp - 5]
cmp esi, ebx
je 0x10012f3
call esi
test eax, eax
jne 0x10012fa
push edi
call dword [0x1001010]
call dword [sym.imp.ole32.dll_CoFreeUnusedLibraries]
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp byte [ebp - 5], bl
je 0x100179c
cmp dword [ebp - 0x24], ebx
pop edi
jne 0x1001a4a
cmp dword [ebp - 0x20], ebx
jne 0x1001a5c
cmp dword [ebp - 0x14], ebx
je 0x1001330
push dword [ebp - 0x14]
call dword [0x1001024]
push dword [ebp - 0x40]
call dword [0x100104c]
nop
nop
nop
nop
nop
nop
nop
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x10013af
push edi
dec ebp
push eax
pop edi
aaa
xor byte [edi + 0x43], bl
push 0x466b6365
outsd dx, dword [esi]
jb 0x10013af
je 0x10013ca
jb 0x10013ae
outsb dx, byte [esi]
jae 0x10013dc
popal
outsb dx, byte [esi]
arpl word [ebp + 0x4d], sp
jne 0x10013e3
js 0x1001372
add byte [eax], al
nop
nop
nop
nop
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x10013e7
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
inc ebx
jne 0x1001408
jb 0x10013fd
outsb dx, byte [esi]
je 0x10013f1
jb 0x1001411
imul ebp, dword [edi + 0x6e], 0x7070415c
and byte [eax + 0x61], dl
je 0x1001412
jae 0x1001408
ja 0x100141b
jo 0x100141c
insb byte es:[edi], dx
popal
jns 0x1001418
jb 0x10013e3
js 0x100141d
add byte [eax], al
add byte [eax], al
push eax
popal
je 0x1001428
add byte [eax], al
add byte [eax], al
inc esp
insb byte es:[edi], dx
insb byte es:[edi], dx
inc ebx
popal
outsb dx, byte [esi]
push ebp
outsb dx, byte [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
popal
dec esi
outsd dx, dword [esi]
ja 0x10013d4
ja 0x1001443
jo 0x1001406
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi], ch
das
push ebx
jne 0x1001450
jo 0x1001454
jae 0x1001458
jae 0x1001458
inc esp
imul esp, dword [ecx + 0x6c], 0x73676f
popal
insb byte es:[edi], dx
outsd dx, dword [esi]
jae fcn.010013ed
in al, dx
or al, 0x8b
inc eax
adc byte [ecx + 0x1000000], bh
inc dword [edx]
test byte [eax + 0x1000000], bh
mov eax, 0x1000000
add byte [eax], al
add byte [ecx], al
add dword [eax], eax
add byte [ebp + 0x281], cl
add dword [ebp - 0x3ba762e], eax
adc byte [eax], al
add dword [ebp + 0x34840fc0], eax
add dword [eax], eax
add byte [ebx + 0x5e5f0c4d], cl
or al, 0x5f
add dword [ebx - 0x37], ebx
or byte [eax], al
push ecx
push edx
push eax
push 0x1001ec8
call fcn.010013ed
pop edx
pop ecx
jmp eax
movzx eax, word [ebp - 0x7c]
jmp 0x10012d3
cmp eax, 5
jne 0x10011a4
jmp 0x100130f
cmp byte [ebp - 6], bl
je 0x1001968
jmp 0x100130f
cmp byte [ebp - 6], bl
mov dword [ebp - 0x14], ebx
jne 0x100181a
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push 0xc0000002
push ebx
push 0x2900
call dword [0x1001058]
test eax, eax
je 0x100181a
push 0x1001ae4
call dword [0x1001054]
push 0x10
push 0x1001a70
push dword [ebp - 0x14]
push ebx
call dword [0x10010b8]
push dword [ebp - 0x14]
call dword [0x1001050]
pop esi
pop ebx
leave
ret
push 0x1001adc
push esi
call fcn.01001590
test eax, eax
pop ecx
pop ecx
je 0x1001155
push esi
call edi
mov esi, eax
lea eax, [esi + esi + 2]
push eax
push ebx
push dword [ebp - 0x18]
call dword [0x1001038]
cmp eax, ebx
mov dword [ebp - 0x20], eax
je 0x100115e
inc esi
push esi
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push ebx
push 0xfde9
call dword [0x1001034]
test eax, eax
jne 0x100188e
mov esi, dword [0x1001084]
call esi
test eax, eax
jg 0x100187a
call esi
jmp 0x1001886
call esi
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jl 0x100115e
mov eax, dword [ebp - 0x20]
jmp 0x100115b
push dword [ebp - 0x14]
call dword [0x1001024]
push ebx
push 0x1001b10
mov dword [ebp - 0x14], ebx
call dword [0x1001090]
test byte [ebp - 0x80], 1
je 0x10018ba
cmp word [ebp - 0x7c], bx
je 0x10018bc
xor esi, esi
cmp eax, ebx
je 0x10018ca
cmp esi, ebx
jne 0x10018ca
push eax
call fcn.01001c23
push esi
push dword [ebp - 0x10]
call fcn.01001b90
jmp 0x100130f
call dword [0x1001084]
jmp 0x100178e
cmp dword [ebp - 4], ebx
mov esi, 0x1001ac8
je 0x100194e
push dword [ebp - 4]
call edi
push esi
mov dword [ebp - 0xc], eax
call edi
mov ecx, dword [ebp - 0xc]
lea edi, [ecx + eax + 1]
push edi
push ebx
push dword [ebp - 0x18]
call dword [0x1001038]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x100194e
push esi
push edi
push eax
call fcn.01001d36
push dword [ebp - 4]
push edi
push dword [ebp - 0x10]
call fcn.01001d86
push 0xa
push ebx
push dword [ebp - 0x10]
push 0x1001ab8
push 0x1001ad4
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push dword [ebp - 0x10]
push ebx
push dword [ebp - 0x18]
call dword [0x100101c]
jmp 0x100130f
push 0xa
push ebx
push esi
push 0x1001ab8
push 0x1001ad4
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x100130f
mov eax, dword [ebp - 0x24]
cmp eax, ebx
mov esi, dword [0x1001058]
mov dword [ebp - 4], ebx
mov edi, 0x2900
je 0x10019da
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x30]
shr eax, 0x10
mov dword [ebp - 0x64], eax
movzx eax, word [ebp - 0x30]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x3c]
shr eax, 0x10
mov dword [ebp - 0x5c], eax
movzx eax, word [ebp - 0x3c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x38]
shr eax, 0x10
mov dword [ebp - 0x54], eax
movzx eax, word [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
shr eax, 0x10
mov dword [ebp - 0x4c], eax
movzx eax, word [ebp - 0x34]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x68]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0xc0000003
push ebx
push edi
call esi
mov eax, dword [ebp - 4]
cmp eax, ebx
jne 0x10019e3
mov dword [ebp - 0xc], 0x1001ad2
jmp 0x10019e6
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0xc0000001
push ebx
push edi
call esi
test eax, eax
je 0x1001a33
push 0x1001ae4
call dword [0x1001054]
push 0x14
push 0x1001a70
push dword [ebp - 4]
push ebx
call dword [0x10010b8]
cmp eax, 6
jne 0x1001a33
push 0xa
push ebx
push ebx
push 0x1001a88
push 0x1001ad4
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [ebp - 4], ebx
je 0x100130f
push dword [ebp - 4]
call dword [0x1001050]
jmp 0x100130f
push dword [ebp - 0x24]
push ebx
push dword [ebp - 0x18]
call dword [0x100101c]
jmp 0x1001319
push dword [ebp - 0x20]
push ebx
push dword [ebp - 0x18]
call dword [0x100101c]
jmp 0x1001322