Function at 0x10009600
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Query or enumerate registry value
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10033ad8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 6
mov dword [ebp - 0x118], eax
call fcn.1000fe62
add esp, 4
test eax, eax
je 0x10009638
mov dword [eax], 0x2ca189e9
mov word [eax + 4], 0x9000
jmp 0x1000963a
xor eax, eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 6
push eax
push 0x520e72
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call ebx
push 5
call fcn.1000fe62
add esp, 4
test eax, eax
je 0x10009672
mov dword [eax], 0x3b084be9
mov byte [eax + 4], 0
jmp 0x10009674
xor eax, eax
push 0
push 5
push eax
push 0x43aff0
call edi
push eax
call ebx
push 0
push 0
push 0
push 0x1000ab40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
push 0xa
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
call fcn.10006320
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x110]
push eax
push 1
lea eax, [ebp - 0x109]
mov byte [ebp - 0x109], 0xe9
push eax
push 0x5b7f1d
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, 0x10007fd0
sub eax, 0x5b7f22
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x110]
push eax
push 4
lea eax, [ebp - 0x114]
push eax
push 0x5b7f1e
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x110]
mov byte [ebp - 0x109], 0xe9
push eax
push 1
lea eax, [ebp - 0x109]
push eax
push 0x4fa866
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, 0x10007fb0
sub eax, 0x4fa86b
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x110]
push eax
push 4
lea eax, [ebp - 0x114]
push eax
push 0x4fa867
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x110]
mov byte [ebp - 0x109], 0xe9
push eax
push 1
lea eax, [ebp - 0x109]
push eax
push 0x5bc668
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, 0x10008190
sub eax, 0x5bc66d
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x110]
push eax
push 4
lea eax, [ebp - 0x114]
push eax
push 0x5bc669
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x110]
mov byte [ebp - 0x109], 0xe9
push eax
push 1
lea eax, [ebp - 0x109]
push eax
push 0x4f6d58
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, 0x10008170
sub eax, 0x4f6d5d
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x110]
push eax
push 4
lea eax, [ebp - 0x114]
push eax
push 0x4f6d59
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x110]
mov byte [ebp - 0x109], 0xe9
push eax
push 1
lea eax, [ebp - 0x109]
push eax
push 0x51e975
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, 0x10008120
sub eax, 0x51e97a
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x110]
push eax
push 4
lea eax, [ebp - 0x114]
push eax
push 0x51e976
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x110]
mov byte [ebp - 0x109], 0xe9
push eax
push 1
lea eax, [ebp - 0x109]
push eax
push 0x5b1418
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, 0x10008100
sub eax, 0x5b141d
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x110]
push eax
push 4
lea eax, [ebp - 0x114]
push eax
push 0x5b1419
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push 0
push 0x1000ac70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0x3e8
push esi
call ebx
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x120]
push eax
push 0x40
push 0xb
push 0x42fc2c
call esi
mov eax, 0x42fc2c
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 8], cx
mov byte [eax + 0xa], cl
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
push 0xb
push 0x42fc2c
call esi
lea eax, [ebp - 0x120]
push eax
push 0x40
push 5
push 0x42fc83
call esi
mov byte [0x42fc83], 0xe9
mov eax, 0x10006b20
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
add eax, 0xffbd0378
mov dword [0x42fc84], eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
push 5
push 0x42fc83
call esi
lea eax, [ebp - 0x120]
push eax
push 0x40
push 1
push 0x42fc88
call esi
mov eax, 0x42fc88
mov byte [eax], 0x90
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
push 1
push 0x42fc88
call esi
call fcn.10007ff0
test al, al
je 0x10009a46
push dword [ebp - 0x118]
call fcn.10007240
add esp, 4
call fcn.100081b0
call fcn.10007ff0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test al, al
je 0x10009a4c
lea eax, [ebp - 0x118]
mov byte [ebp - 0x109], 0xe9
push eax
push 1
lea eax, [ebp - 0x109]
push eax
push 0x51d1d7
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call ebx
mov eax, 0x10002fa0
sub eax, 0x51d1dc
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x118]
push eax
push 4
lea eax, [ebp - 0x110]
push eax
push 0x51d1d8
call edi
push eax
call ebx
lea eax, [ebp - 0x120]
push eax
push 0x40
push 2
push 0x51d1dc
call esi
mov eax, 0x51d1dc
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
push 2
push 0x51d1dc
call esi
jmp 0x10009a52
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.10010ba0
add esp, 0xc
mov dword [ebp - 0x118], 0x104
lea eax, [ebp - 0x114]
push eax
push 0x20019
push 0
push str.SOFTWAREVooblyVooblygame13double_click_Selection
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10009bd4
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x11c]
push eax
push 0
push str.double_click_Selection
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, str.true
lea eax, [ebp - 0x108]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009af8
test dl, dl
je 0x10009aec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009af8
add eax, 2
add ecx, 2
test dl, dl
jne 0x10009ad0
mov dword [ebp - 0x110], 0
jmp 0x10009b03
sbb eax, eax
or eax, 1
mov dword [ebp - 0x110], eax
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x110], 0
jne 0x10009bd4
lea eax, [ebp - 0x120]
push eax
push 0x40
push 0xb
push 0x42fc2c
call esi
mov eax, 0x42fc2c
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 8], cx
mov byte [eax + 0xa], cl
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
push 0xb
push 0x42fc2c
call esi
lea eax, [ebp - 0x120]
push eax
push 0x40
push 5
push 0x42fc83
call esi
mov byte [0x42fc83], 0xe9
mov eax, 0x10006b20
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
add eax, 0xffbd0378
mov dword [0x42fc84], eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
push 5
push 0x42fc83
call esi
lea eax, [ebp - 0x120]
push eax
push 0x40
push 1
push 0x42fc88
call esi
mov eax, 0x42fc88
mov byte [eax], 0x90
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
push 1
push 0x42fc88
call esi
call fcn.10007880
test al, al
je 0x10009d46
push 0x10004ac0
push 0x51d1f6
call fcn.10009d60
push 0x10006520
push 0x4bd382
call fcn.10009d60
add esp, 0x10
mov byte [ebp - 0x109], 0xe8
lea eax, [ebp - 0x118]
push eax
push 1
lea eax, [ebp - 0x109]
push eax
push 0x4bbedb
call edi
push eax
call ebx
mov eax, 0x10003cb0
sub eax, 0x4bbee0
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x118]
push eax
push 4
lea eax, [ebp - 0x110]
push eax
push 0x4bbedc
call edi
push eax
call ebx
lea eax, [ebp - 0x118]
mov byte [ebp - 0x109], 0xe9
push eax
push 1
lea eax, [ebp - 0x109]
push eax
push 0x4bd38a
call edi
push eax
call ebx
mov eax, 0x10004b00
sub eax, 0x4bd38f
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x118]
push eax
push 4
lea eax, [ebp - 0x110]
push eax
push 0x4bd38b
call edi
push eax
call ebx
lea eax, [ebp - 0x120]
push eax
push 0x40
push 1
push 0x4bd38f
call esi
mov eax, 0x4bd38f
mov byte [eax], 0x90
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
push 1
push 0x4bd38f
call esi
lea eax, [ebp - 0x118]
mov byte [ebp - 0x109], 0xe9
push eax
push 1
lea eax, [ebp - 0x109]
push eax
push 0x523062
call edi
push eax
call ebx
mov eax, 0x10003950
sub eax, 0x523067
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x118]
push eax
push 4
lea eax, [ebp - 0x110]
push eax
push 0x523063
call edi
push eax
call ebx
lea eax, [ebp - 0x120]
push eax
push 0x40
push 4
push 0x523067
call esi
mov eax, 0x523067
mov dword [eax], 0x90909090
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x120]
push 4
push 0x523067
call esi
call fcn.10009230
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000fe79
mov esp, ebp
pop ebp
ret