Function at 0x1009d35
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3d0]
push eax
call esi
test eax, eax
je 0x1009e95
lea eax, [ebp - 0x3d0]
push eax
call fcn.01001afa
test eax, eax
jne 0x10016a8
lea eax, [ebp - 0x3d0]
push eax
push dword [0x101e0a8]
push dword [0x101e098]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x10016a8
lea eax, [ebp - 0x3d0]
push eax
push dword [0x101e098]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x10016a8
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3d0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x10016a8
cmp eax, esi
je 0x1009e95
push 0x101e474
push 0x101e46c
push 0x101e468
call fcn.0100623d
cmp dword [0x101e468], ebx
je 0x1005248
push 0x101e478
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea eax, [ebp - 0x3a8]
push eax
push 0x20019
push ebx
push 0x1005280
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1009e02
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.010083e8
jmp 0x1009f19
call fcn.01005fdd
call fcn.01006474
test al, al
je 0x10081d5
push ebx
push 0x10015e5
push ebx
push 0x69
push dword [ebp - 0x3b4]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov dword [0x101e098], eax
cmp eax, ebx
jne 0x100a06a
jmp 0x10081d5
mov eax, dword [0x101e14c]
mov ecx, dword [0x101e154]
mov edx, dword [0x101e150]
push 4
sub ecx, eax
push ecx
mov ecx, dword [0x101e148]
sub edx, ecx
push edx
push eax
push ecx
push ebx
push dword [0x101e098]
mov dword [0x101f804], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [ebp + 0x14]
push dword [0x101e098]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x101e098]
call fcn.01005ddd
mov eax, dword [0x101e094]
cmp eax, ebx
je 0x1005dc5
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x10016a8
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov dword [0x101e0a4], edi
call dword [sym.imp.USER32.dll_SetProcessDPIAware]
push 0x100642c
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push esi
mov dword [0x101f6b8], eax
call fcn.0100de8d
jmp 0x1009df5
cmp dword [0x101e468], ebx
je 0x10081f2
cmp dword [0x101e46c], ebx
jne 0x10081f2
push 0x50
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
je 0x100a047
mov ecx, eax
call fcn.01006365
jmp 0x100a049
mov ecx, eax
call fcn.010062d5
jmp 0x1009fcf
mov dword [ebp - 0x3a0], ebx
jmp 0x1009e95
mov eax, dword [0x101fdc8]
cmp eax, ebx
jne 0x1009efe
jmp 0x1008f55
dec dword [0x101e0d8]
jmp 0x10053fc
push ebx
push ebx
push esi
push ebx
mov dword [0x101fac8], eax
mov dword [0x101facc], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x101e0b0
push ebx
mov edi, eax
push edi
push 0x10017d5
push ebx
push ebx
mov dword [ebp - 0x3a4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x101e0b4], eax
cmp edi, ebx
je 0x1008243
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x4c
mov dword [0x101e0d8], 6
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
je 0x1009fab
mov ecx, eax
call fcn.01006325
jmp 0x1009fad
call fcn.01007efd
test al, al
jne 0x100a05b
push 0x8c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
jne 0x100a008
jmp 0x100a011
mov ecx, eax
call fcn.0100b3d5
jmp 0x100a035
mov ecx, dword [0x101e548]
cmp ecx, ebx
je 0x1008eef
mov eax, dword [ecx]
push 1
call dword [eax + 0x1c]
mov ecx, dword [0x101e54c]
cmp ecx, ebx
je 0x1008f00
mov eax, dword [ecx]
push 1
call dword [eax + 0x1c]
mov ecx, dword [0x101e550]
cmp ecx, ebx
je 0x1008f11
mov eax, dword [ecx]
push 1
call dword [eax + 0x1c]
mov ecx, dword [0x101e554]
cmp ecx, ebx
je 0x1008f22
mov eax, dword [ecx]
push 1
call dword [eax + 0x1c]
mov ecx, dword [0x101e558]
cmp ecx, ebx
je 0x1008f33
push 1
call fcn.01008f8d
mov ecx, dword [0x101e55c]
cmp ecx, ebx
je 0x1008f44
mov eax, dword [ecx]
push 1
call dword [eax + 0x1c]
cmp dword [ebp - 0x3a4], ebx
jne 0x1009ef1
jmp 0x10081e0
cmp dword [0x101f820], ebx
pop edi
pop esi
pop ebx
je 0x1009f0a
push 0x101f808
call dword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
jmp 0x1009f0a
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x3a0]
xor ecx, ebp
call fcn.01001679
leave
ret 0x10
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3d4
mov eax, dword [0x101e08c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x101fd80
push 0x101fd88
xor esi, esi
push 0x100dc8f
xor ebx, ebx
inc esi
push 0x100a080
mov dword [ebp - 0x3b4], edi
mov dword [ebp - 0x3a0], esi
mov dword [ebp - 0x3ac], ebx
mov dword [ebp - 0x3a4], ebx
call fcn.0100dce6
cmp dword [0x101fdac], ebx
je 0x10063e7
mov al, byte [0x101fdb0]
cmp al, 4
jae 0x1009da3
cmp al, bl
jne 0x10063e7
mov ecx, dword [0x101fd9c]
mov edx, 0x80010000
and ecx, edx
xor eax, eax
or eax, ecx
je 0x10063e7
mov ecx, dword [0x101fda4]
mov eax, ecx
and eax, edx
xor edx, edx
cmp edx, dword [0x101fda0]
jne 0x10063e7
cmp eax, ecx
jne 0x10063e7
push 0x100a090
push dword [0x101fd84]
push dword [0x101fd80]
call fcn.0100dd43
jmp 0x10063e7
cmp eax, ebx
jge 0x1005212
jmp 0x1009e95
lea eax, [ebp - 0x3b0]
push eax
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x3d4]
push eax
push ebx
push 0x100a0a0
push dword [ebp - 0x3a8]
mov dword [ebp - 0x3b0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x3a8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x3ac], ebx
je 0x100526d
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea eax, [ebp - 0x39c]
push eax
push 0x2729
push edi
call esi
push 0xc8
lea eax, [ebp - 0x194]
push eax
push 0x272a
push edi
call esi
push 0x10
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x194]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x10081d5
mov eax, dword [0x101e094]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
cmp eax, ebx
je 0x1009ec4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x101e094]
cmp eax, ebx
je 0x1009ec4
cmp eax, esi
je 0x1009ec4
push eax
call edi
mov dword [0x101e094], esi
mov eax, dword [0x101fdb8]
test eax, eax
je 0x1008ede
mov eax, dword [0x101fdb8]
cmp eax, esi
je 0x1008ede
push dword [0x101fdb8]
call edi
mov dword [0x101fdb8], esi
jmp 0x1008ede
push dword [ebp - 0x3a4]
call edi
jmp 0x10081e0
push eax
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
jmp 0x1008f55
push 0x101fd80
call fcn.0100dd12
jmp 0x1008f74
call fcn.0100da8d
call dword [sym.imp.KERNEL32.dll_GetErrorMode]
or eax, 0x8001
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x101f808
call dword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
test eax, eax
jl 0x10081d5
mov dword [0x101f820], esi
mov dword [0x101fac0], 3
mov dword [0x101fac8], ebx
mov dword [0x101facc], ebx
mov dword [0x101fad0], ebx
mov dword [0x101fad4], ebx
mov dword [0x101fad8], ebx
mov dword [0x101fadc], ebx
mov dword [0x101fae0], esi
mov dword [0x101fae4], 0x28
mov dword [0x101fdc4], esi
mov dword [0x101fac4], ebx
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
mov dword [0x101fdc8], eax
cmp eax, ebx
jne 0x10081fd
jmp 0x10081d5
xor eax, eax
mov dword [0x101e548], eax
cmp eax, ebx
je 0x10081d5
push 0x27c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
jne 0x10081c9
xor eax, eax
mov dword [0x101e54c], eax
cmp eax, ebx
je 0x10081d5
push 0x3290
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
je 0x1009ff4
mov ecx, eax
call fcn.0100e0ad
jmp 0x1009ff6
xor eax, eax
mov dword [0x101e550], eax
cmp eax, ebx
jne 0x1008269
jmp 0x10081d5
mov ecx, eax
call fcn.010102a9
jmp 0x100a013
xor eax, eax
mov dword [0x101e554], eax
cmp eax, ebx
je 0x10081d5
push 0x80
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, ebx
jne 0x100828e
xor eax, eax
mov dword [0x101e558], eax
cmp eax, ebx
jne 0x100819d
jmp 0x10081d5
xor eax, eax
mov dword [0x101e55c], eax
cmp eax, ebx
je 0x10081d5
jmp 0x10053fc
mov dword [0x101e0d8], 3
jmp 0x10053fc
push ebx
push esi
push 0x40b
push eax
call dword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
jmp 0x1005d67