Function at 0x10029f69
Capabilities:
Create process on windows
Delete registry value
Query or enumerate registry value

Disassembly:
sub esp, 0x888
mov eax, dword [0x1024bd20]
xor eax, esp
mov dword [esp + 0x884], eax
and dword [esp], 0
lea eax, [esp + 0x84]
push ebx
push ebp
mov ebp, dword [esp + 0x894]
push esi
push edi
push 0x10255788
push 0x101d43f8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0xa
call fcn.10028633
add esp, 0x10
push 0x31
pop ecx
cmp word [eax], cx
jne 0x1002a06d
mov eax, dword [section..data]
mov ebx, section..data
mov esi, 0x101d4a68
cmp eax, ebx
je 0x10029fde
push esi
push 0x3a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
push 0x101d4418
xor edi, edi
lea eax, [esp + 0x98]
push 0x400
inc edi
push eax
mov dword [esp + 0x20], edi
call fcn.1017c18a
push 0x13
call fcn.10028633
add esp, 0x10
push 0x31
pop ecx
cmp word [eax], cx
jne 0x1002a028
push str.__showgui
lea eax, [esp + 0x98]
push 0x400
push eax
call fcn.1017c18a
add esp, 0xc
push 0
lea eax, [esp + 0x14]
push eax
push 0x1f0003
push 0
push 0x101d4434
call fcn.10028a13
add esp, 0x14
mov dword [ebp], eax
test eax, eax
je 0x1002a097
mov eax, dword [section..data]
cmp eax, ebx
je 0x1002a26f
push esi
push 0x3b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
jmp 0x1002a26f
mov eax, dword [section..data]
mov ebx, section..data
mov esi, 0x101d4a68
cmp eax, ebx
je 0x1002a091
push esi
push 0x3c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
xor edi, edi
mov dword [esp + 0x14], edi
cmp word [0x10255788], 0
je 0x1002a256
push 0x40
lea eax, [esp + 0x38]
push 0
push eax
call fcn.10179250
add esp, 0xc
mov dword [esp + 0x30], 0x44
xorps xmm0, xmm0
movdqu xmmword [esp + 0x20], xmm0
push 0x101d443c
push dword [0x10255dac]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [section..data]
cmp eax, ebx
je 0x1002a0f2
push esi
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
push dword [0x102556dc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor ecx, ecx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [esp + 0xb4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1002a149
mov eax, dword [section..data]
cmp eax, ebx
je 0x1002a13d
push esi
push 0x3e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
mov dword [ebp], 0x12
jmp 0x1002a26f
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7530
push dword [0x10255784]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1002a180
mov eax, dword [section..data]
cmp eax, ebx
je 0x1002a13d
push esi
push 0x3f
jmp 0x1002a12f
test edi, edi
je 0x1002a252
push 0xffffffffffffffff
push dword [0x102556dc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
je 0x1002a1c7
test eax, eax
je 0x1002a1c7
mov eax, dword [section..data]
cmp eax, ebx
je 0x1002a1bb
push esi
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
mov dword [ebp], 0x15
jmp 0x1002a26f
push 7
pop ecx
xor eax, eax
mov dword [esp + 0x1c], 0x20
mov word [esp + 0x74], ax
lea edi, [esp + 0x76]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x101d4440
push dword [0x10255dac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002a21e
cmp dword [esp + 0x18], 1
jne 0x1002a21e
lea eax, [esp + 0x74]
push eax
call fcn.1002b409
pop ecx
mov dword [ebp], eax
jmp 0x1002a23f
mov eax, dword [section..data]
cmp eax, ebx
je 0x1002a238
push esi
push 0x41
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
mov dword [ebp], 0x15
push 0x101d4444
push dword [0x10255dac]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x1002a256
and dword [ebp], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1002a265
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x14]
call fcn.100297a6
pop ecx
mov ecx, dword [esp + 0x894]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1017868e
add esp, 0x888
ret