Function at 0x1000a240
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005639d
mov eax, dword fs:[0]
push eax
sub esp, 0x2b4
mov eax, dword [0x1007105c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
mov dword [ebp - 0x2b8], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x2b0], 0x68
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov ecx, dword [ebp - 0x2a4]
sub ecx, dword [ebp - 0x2ac]
mov eax, dword [ebp - 0x2a0]
sub eax, dword [ebp - 0x2a8]
mov dword [0x10073cf0], ecx
lea ecx, [ebp - 0x248]
mov dword [0x10073cf4], eax
call fcn.10011aa0
cmp dword [eax + 0x14], 0x10
jb 0x1000a2d5
mov eax, dword [eax]
push eax
push 0x10065e88
push 0x10073de8
call fcn.100088c0
mov edx, dword [ebp - 0x234]
add esp, 0xc
cmp edx, 0x10
jb 0x1000a322
mov ecx, dword [ebp - 0x248]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a318
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000ab9c
push edx
push ecx
call fcn.1003255c
add esp, 8
movaps xmm0, xmmword [0x1006a450]
lea edi, [ebp - 0x228]
mov eax, 0x80000002
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x228], xmm0
pop ebx
mov dword [edi], eax
lea eax, [ebp - 0x22c]
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
push dword [ebp - 0x224]
push dword [ebp - 0x228]
push str._08X_08X
push eax
call fcn.100088c0
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x248], 0
add esp, 0x10
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000a395
sub ecx, edx
lea eax, [ebp - 0x22c]
push ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.1000c910
cmp dword [ebp - 0x234], 0x10
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
push 0x10065e88
push 0x10073f00
call fcn.100088c0
mov edx, dword [ebp - 0x234]
add esp, 0xc
cmp edx, 0x10
jb 0x1000a412
mov ecx, dword [ebp - 0x248]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a408
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000aba1
push edx
push ecx
call fcn.1003255c
add esp, 8
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x2b8], 0x101
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
test eax, eax
je 0x1000a473
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000a460
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
jmp 0x1000a47a
push 0
push 0x10064b87
lea ecx, [ebp - 0x230]
call fcn.1000c910
cmp dword [ebp - 0x21c], 0x10
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x10065e88
push 0x10073e40
call fcn.100088c0
mov edx, dword [ebp - 0x21c]
add esp, 0xc
cmp edx, 0x10
jb 0x1000a4e6
mov ecx, dword [ebp - 0x230]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a4dc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000aba6
push edx
push ecx
call fcn.1003255c
add esp, 8
lea ecx, [ebp - 0x248]
call fcn.10011b90
cmp dword [eax + 0x14], 0x10
jb 0x1000a4f9
mov eax, dword [eax]
push eax
push 0x10065e88
push 0x10073e94
call fcn.100088c0
mov edx, dword [ebp - 0x234]
add esp, 0xc
cmp edx, 0x10
jb 0x1000a546
mov ecx, dword [ebp - 0x248]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a53c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000abab
push edx
push ecx
call fcn.1003255c
add esp, 8
push 0x17
mov dword [ebp - 0x248], 0
lea ecx, [ebp - 0x248]
push str.wmic_csproduct_get_uuid
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
call fcn.1000c910
lea edx, [ebp - 0x248]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.100117f0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x234]
cmp edx, 0x10
jb 0x1000a5d6
mov ecx, dword [ebp - 0x248]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a5cc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000abb0
push edx
push ecx
call fcn.1003255c
add esp, 8
cmp dword [ebp - 0x21c], 0x10
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x10065e88
push 0x10073ec8
call fcn.100088c0
mov edx, dword [ebp - 0x21c]
add esp, 0xc
cmp edx, 0x10
jb 0x1000a637
mov ecx, dword [ebp - 0x230]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a62d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000abb5
push edx
push ecx
call fcn.1003255c
add esp, 8
lea eax, [ebp - 0x2b4]
mov dword [ebp - 4], 1
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftCryptography
mov dword [ebp - 0x230], 0
push 0x80000002
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0xf
mov byte [ebp - 0x230], 0
mov dword [ebp - 0x2b8], 0xf
mov dword [ebp - 0x2bc], 0x40
mov dword [ebp - 0x2c0], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x2c0]
push eax
push 0
push str.MachineGuid
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
jne 0x1000a6fc
test eax, eax
jne 0x1000a6fc
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000a6e0
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.1000c910
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x21c], 0x10
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x10065e88
push 0x10073d74
call fcn.100088c0
mov dword [ebp - 4], 0xffffffff
add esp, 0xc
mov edx, dword [ebp - 0x21c]
cmp edx, 0x10
jb 0x1000a770
mov ecx, dword [ebp - 0x230]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a766
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000abba
push edx
push ecx
call fcn.1003255c
add esp, 8
push 0x18
mov dword [ebp - 0x248], 0
lea ecx, [ebp - 0x248]
push str.wmic_cpu_get_processorid
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
call fcn.1000c910
lea edx, [ebp - 0x248]
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x230]
call fcn.100117f0
mov edx, dword [ebp - 0x234]
cmp edx, 0x10
jb 0x1000a7f9
mov ecx, dword [ebp - 0x248]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a7ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000abbf
push edx
push ecx
call fcn.1003255c
add esp, 8
cmp dword [ebp - 0x21c], 0x10
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x10065e88
push 0x10073f3c
call fcn.100088c0
mov edx, dword [ebp - 0x21c]
add esp, 0xc
cmp edx, 0x10
jb 0x1000a85a
mov ecx, dword [ebp - 0x230]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000a850
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000abc4
push edx
push ecx
call fcn.1003255c
add esp, 8
mov edx, str.xxxx____x____x____xxx____xx____xxxxx____xxxx____xxxxxxxxx____xxx
mov ecx, 0x10065ed8
call fcn.10017960
mov edx, str.xxx____x____xxxxxx____xx_____xx____xxx
mov dword [0x10073c9c], eax
mov ecx, 0x10065f64
call fcn.10017960
mov edx, str.xxx____xxxxx____xxxx____x____x____x____xx____xx____xx
mov dword [0x10073c90], eax
mov ecx, 0x10065fb4
call fcn.10017960
mov edx, str.xxxxxxxxx
mov dword [0x10073cc0], eax
mov ecx, 0x10066024
call fcn.10017960
mov edx, str.xxxxxx____xxxxxxxxx____xxxxx
mov dword [0x10073cbc], eax
mov ecx, 0x1006603c
call fcn.10017960
mov edx, str.xxx____xxxxx____xxxx____xxx____x____xx____xxxxxxxxx____xx____xx____xxxx____x
mov dword [0x10073cac], eax
mov ecx, 0x10066080
call fcn.10017960
mov edx, str.xxxxx____x____xxxxxxxxxxxx
mov dword [0x10073cc4], eax
mov ecx, 0x10066120
call fcn.10017960
mov dword [0x10073c98], eax
test eax, eax
jne 0x1000a8fe
mov edx, str.xxxxx____x____xxxxxxxxxxxxx
mov ecx, 0x10066158
call fcn.10017960
mov dword [0x10073c98], eax
call fcn.1001aac0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.1001afa0
push fcn.10009cf0
push 0x10073c9c
call fcn.1001a550
call fcn.1001ab20
test eax, eax
jne 0x1000ab97
call fcn.1001aac0
call esi
push eax
call fcn.1001afa0
push 0x10009e60
push 0x10073c90
call fcn.1001a550
call fcn.1001ab20
test eax, eax
jne 0x1000ab97
call fcn.1001aac0
call esi
push eax
call fcn.1001afa0
push 0x10009f20
push 0x10073cc0
call fcn.1001a550
call fcn.1001ab20
test eax, eax
jne 0x1000ab97
call fcn.1001aac0
call esi
push eax
call fcn.1001afa0
push 0x10009fd0
push 0x10073cbc
call fcn.1001a550
call fcn.1001ab20
test eax, eax
jne 0x1000ab97
call fcn.1001aac0
call esi
push eax
call fcn.1001afa0
push 0x1000a0c0
push 0x10073cac
call fcn.1001a550
call fcn.1001ab20
test eax, eax
jne 0x1000ab97
call fcn.1001aac0
call esi
push eax
call fcn.1001afa0
push 0x10009c50
push 0x10073f70
call fcn.1001a550
call fcn.1001ab20
test eax, eax
jne 0x1000ab97
call fcn.1001aac0
call esi
push eax
call fcn.1001afa0
push 0x1000a170
push 0x10071ad4
call fcn.1001a550
call fcn.1001ab20
test eax, eax
jne 0x1000ab97
call fcn.1001aac0
call esi
push eax
call fcn.1001afa0
push 0x1000a0e0
push 0x10073cc4
call fcn.1001a550
call fcn.1001ab20
test eax, eax
jne 0x1000ab97
call fcn.1001aac0
call esi
push eax
call fcn.1001afa0
push 0x1000a100
push 0x10073c98
call fcn.1001a550
call fcn.1001ab20
test eax, eax
jne 0x1000ab97
mov eax, dword [0x10073cf0]
mov ecx, 0x400
mov edi, dword [0x10073cf4]
cmp eax, ecx
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
cmovl eax, ecx
mov ecx, 0x300
push eax
cmp edi, ecx
mov dword [0x10073cf0], eax
lea eax, [ebp - 0x218]
cmovl edi, ecx
push 0x1006a2bc
push eax
mov dword [0x10073cf4], edi
call esi
add esp, 0xc
lea eax, [ebp - 0x118]
push edi
push 0x1006a2bc
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x218]
add esp, 0xc
push str..._ini_GameSetup.ini
push eax
push str.ScrWidth
push str.ScreenMode
call esi
push str..._ini_GameSetup.ini
lea eax, [ebp - 0x118]
push eax
push str.ScrHeight
push str.ScreenMode
call esi
push str..._ini_GameSetup.ini
push 0x1006a330
push 0x1006a334
push str.ScreenMode
call esi
push str..._ini_GameSetup.ini
push 0x1006a34c
push 0x1006a350
push str.ScreenMode
call esi
mov edi, dword [0x10073f74]
lea eax, [ebp - 0x2b4]
mov ebx, dword [0x100740ac]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push edi
push ebx
mov dword [ebp - 0x2b4], 0
call esi
push 0
push edi
push str.qVKrXjHZYhRPqGsw
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x2b4]
push eax
push dword [ebp - 0x2b4]
push edi
push ebx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003213a
mov esp, ebp
pop ebp
ret
call fcn.1000ee40
call fcn.100387ad
call fcn.100387ad
call fcn.100387ad
call fcn.100387ad
call fcn.100387ad
call fcn.100387ad
call fcn.100387ad
call fcn.100387ad
call fcn.100387ad
int3