Function at 0x100ee9d
Capabilities:
Create pipe
Set registry value

Disassembly:
mov eax, 0x10100b1
call fcn.01003f88
sub esp, 0x40
mov eax, dword [0x1014030]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], esp
mov esi, ecx
push 0x20
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x2c], eax
call fcn.01006394
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
xor edi, edi
push eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], edi
call ebx
push dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
call ebx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
push edi
lea eax, [eax + edx + 9]
lea ecx, [esi + 0x10]
push eax
call fcn.010042c5
cmp dword [0x10141ec], edi
jne 0x100ef83
push 4
call fcn.01006394
lea ecx, [ebp - 0x24]
push ecx
push 0x20006
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
cmp ebx, edi
push edi
je 0x100ef42
push edi
push ebx
push 0x68
push edi
call fcn.010064c6
mov dword [ebp - 0x38], ebx
push 0x10101d0
lea eax, [ebp - 0x38]
push eax
jmp 0x100f0f5
push 0x10141ec
push edi
push 2
push 1
push edi
push edi
push 0x1001fa4
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push dword [ebp - 0x24]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x100ef83
push edi
push edi
push ebx
push 0x67
push edi
call fcn.010064c6
mov dword [ebp - 0x4c], ebx
push 0x10101d0
lea eax, [ebp - 0x4c]
jmp 0x100ef3c
lea ebx, [esi + 0x20]
push edi
mov ecx, ebx
call fcn.010058e6
push 0xd0000000
mov ecx, ebx
call fcn.01005812
push 0x12019b
push 0x100147c
mov ecx, ebx
call fcn.010057b1
push 0x12019b
push 0x1001544
mov ecx, ebx
call fcn.010057b1
mov ebx, 0x200
push 0x10
lea eax, [ebp - 0x20]
push eax
push dword [0x10141e8]
call sub.ntdll.dll__itoa
add esp, 0xc
push dword [ebp - 0x28]
lea ecx, [esi + 0x10]
push dword [ebp - 0x30]
call fcn.01004392
push dword [ebp - 0x48]
lea ecx, [esi + 0x10]
push dword [ebp - 0x2c]
call fcn.010043d4
push 9
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0x10]
call fcn.010043d4
lea ecx, [esi + 0x20]
call fcn.01005797
push eax
push 0x1388
push ebx
push ebx
push 0xff
push edi
push 0x40080003
push edi
lea ecx, [esi + 0x10]
call fcn.010021c5
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push eax
mov ecx, esi
call fcn.010067cc
mov eax, dword [esi]
cmp eax, edi
je 0x100f03d
cmp eax, 0xffffffff
jne 0x100f071
mov eax, dword [esi + 4]
cmp eax, 5
mov dword [ebp - 0x24], eax
jne 0x100f053
inc dword [0x10141e8]
jmp 0x100efc1
push edi
push edi
push eax
push 0x6d
push edi
call fcn.010064c6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
push 0x10101d0
lea eax, [ebp - 0x40]
jmp 0x100ef3c
push 4
push 0x10141e8
push 4
push edi
push edi
push dword [0x10141ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
cmp ebx, edi
push edi
push edi
je 0x100f0a9
push ebx
push 0x66
push edi
call fcn.010064c6
mov dword [ebp - 0x34], ebx
push 0x10101d0
lea eax, [ebp - 0x34]
jmp 0x100ef3c
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ebx, [esi + 0x58]
push eax
mov ecx, ebx
mov dword [esi + 0x54], eax
call fcn.010067cc
mov ebx, dword [ebx]
cmp ebx, edi
je 0x100f0cb
cmp ebx, 0xffffffff
jne 0x100f0fa
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x3c], eax
push 0x10101d0
lea eax, [ebp - 0x3c]
jmp 0x100ef3c
call sub.msvcrt.dll__CxxThrowException
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.01003cd7
pop edi
pop esi
pop ebx
leave
ret 4