Function at 0x1001d515
Capabilities:
Create process on windows
Get common file path
Set registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x10095dec]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x64
mov eax, 0x1006f742
call fcn.1003c0ab
mov esi, dword [ebp + 0x214]
xor ebx, ebx
test byte [ebp + 0x220], 1
je 0x1001d550
mov byte [ebp + 0x218], bl
push esi
lea ecx, [ebp - 0x18]
call fcn.100010b1
push 0x10076f8c
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.100010b1
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.1000132e
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], bl
cmp ecx, ebx
je 0x1001d588
call fcn.10001238
cmp byte [ebp + 0x21c], bl
je 0x1001d92f
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call fcn.1003c260
add esp, 0xc
push esi
lea ecx, [ebp - 0x20]
call fcn.100010b1
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 4], 2
cmp ecx, ebx
je 0x1001d5c7
call fcn.1001ae2b
jmp 0x1001d5c9
xor eax, eax
push eax
push str.wsdetect.dll
call dword [sym.imp.imagehlp.dll_ImageLoad]
cmp eax, ebx
jne 0x1001d678
xor esi, esi
push str.Unexpected_machine_type_from__
lea ecx, [ebp - 0x14]
call fcn.1000b23a
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.1000132e
push str.___machine_type:
lea ecx, [ebp - 0x10]
call fcn.1000b23a
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.1000132e
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x1001d625
call fcn.10001238
push 0x12
pop eax
mov word [ebp - 0x34], ax
mov word [ebp - 0x2c], si
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.1001c56f
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.1000132e
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x1001d65c
call fcn.10001238
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, dword [ebp - 0x14]
cmp esi, ebx
je 0x1001d8fc
mov eax, dword [esi]
jmp 0x1001d8fe
mov ecx, dword [eax + 0xc]
movzx edi, word [ecx + 4]
push eax
call dword [sym.imp.imagehlp.dll_ImageUnload]
test eax, eax
je 0x1001d5dd
mov eax, 0x8664
mov esi, edi
cmp ax, di
jne 0x1001d6ac
mov esi, 0x104
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
jmp 0x1001d6c8
mov eax, 0x14c
cmp ax, di
jne 0x1001d5df
lea esi, [eax - 0x48]
push esi
lea eax, [ebp]
push eax
call dword [sym.imp.kernel32.dll_GetSystemWow64DirectoryW]
push str._regsvr32.exe
lea eax, [ebp]
push esi
push eax
call fcn.10042f0f
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.1003c260
add esp, 0x18
push 0x100771b8
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x70], esi
call fcn.100010b1
mov byte [ebp - 4], 7
cmp byte [ebp + 0x218], bl
jne 0x1001d731
push 0x100771c0
lea ecx, [ebp - 0x14]
call fcn.100010b1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 8
call fcn.1000132e
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 7
cmp ecx, ebx
je 0x1001d731
call fcn.10001238
push 0x100771c8
lea ecx, [ebp - 0x14]
call fcn.100010b1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 9
call fcn.1000132e
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 7
cmp ecx, ebx
je 0x1001d75e
call fcn.10001238
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
call fcn.1000132e
push 0x100771cc
lea ecx, [ebp - 0x14]
call fcn.100010b1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xa
call fcn.1000132e
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 7
cmp ecx, ebx
je 0x1001d797
call fcn.10001238
mov edi, dword [ebp - 0x24]
xor esi, esi
inc esi
lea eax, [ebp]
mov dword [ebp - 0x64], 0x100771d0
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x6c], 0x40
cmp edi, ebx
je 0x1001d7bf
mov eax, dword [edi]
mov dword [ebp - 0x5c], eax
jmp 0x1001d7c2
mov dword [ebp - 0x5c], ebx
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x1c], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1001d7f9
cmp dword [ebp - 0x38], ebx
je 0x1001d7f9
push 0xffffffffffffffff
push dword [ebp - 0x38]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.kernel32.dll_GetExitCodeProcess]
push dword [ebp - 0x38]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [ebp - 0x1c], ebx
je 0x1001d8d2
push str.regsvr32.exe_error__
lea ecx, [ebp - 0x14]
call fcn.1000b23a
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xb
call fcn.100010b1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xc
call fcn.1000132e
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0xb
cmp ecx, ebx
je 0x1001d83f
call fcn.10001238
push str.___error_code:
lea ecx, [ebp - 0x10]
call fcn.1000b23a
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xd
call fcn.1000132e
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x1001d868
call fcn.10001238
push 0x13
pop eax
mov word [ebp - 0x34], ax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xe
call fcn.1001c56f
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xf
call fcn.1000132e
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x1001d8a1
call fcn.10001238
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, dword [ebp - 0x14]
cmp esi, ebx
je 0x1001d8b6
mov eax, dword [esi]
jmp 0x1001d8b8
xor eax, eax
push eax
call fcn.10042f0f
pop ecx
cmp esi, ebx
je 0x1001d8ca
mov ecx, esi
call fcn.10001238
cmp edi, ebx
je 0x1001d910
mov ecx, edi
jmp 0x1001d90b
cmp edi, ebx
je 0x1001d8dd
mov ecx, edi
call fcn.10001238
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
je 0x1001d8e9
call fcn.10001238
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x1001d8f5
call fcn.10001238
mov eax, esi
jmp 0x1001da9e
xor eax, eax
push eax
call fcn.10042f0f
pop ecx
cmp esi, ebx
je 0x1001d910
mov ecx, esi
call fcn.10001238
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
je 0x1001d91c
call fcn.10001238
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x1001d928
call fcn.10001238
xor eax, eax
jmp 0x1001da9e
mov edi, dword [ebp - 0x18]
cmp edi, ebx
je 0x1001d93a
mov eax, dword [edi]
jmp 0x1001d93c
xor eax, eax
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
jne 0x1001da09
call dword [sym.imp.kernel32.dll_GetLastError]
push str.Failed_to_load__
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.1000b23a
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x10
call fcn.1000132e
push str.___error_code
lea ecx, [ebp - 0x10]
call fcn.1000b23a
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x11
call fcn.1000132e
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x1001d99b
call fcn.10001238
push 0x13
pop eax
mov word [ebp - 0x34], ax
mov dword [ebp - 0x2c], esi
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x12
call fcn.1001c56f
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x13
call fcn.1000132e
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x1001d9d1
call fcn.10001238
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, dword [ebp - 0x20]
cmp esi, ebx
je 0x1001d9e6
mov eax, dword [esi]
jmp 0x1001d9e8
xor eax, eax
push eax
call fcn.10042f0f
pop ecx
cmp esi, ebx
je 0x1001d9fa
mov ecx, esi
call fcn.10001238
cmp edi, ebx
je 0x1001d928
mov ecx, edi
jmp 0x1001d923
mov edi, str.DllRegisterServer
cmp byte [ebp + 0x218], bl
jne 0x1001da1b
mov edi, str.DllUnregisterServer
push edi
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
cmp eax, ebx
jne 0x1001da80
push str.Failed_to_get_proc_address:
lea ecx, [ebp - 0x1c]
call fcn.1000b23a
push edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x14
call fcn.1000b23a
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x15
call fcn.1000132e
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x1001da5d
call fcn.10001238
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
je 0x1001da68
mov eax, dword [esi]
jmp 0x1001da6a
xor eax, eax
push eax
call fcn.10042f0f
pop ecx
cmp esi, ebx
je 0x1001d91c
mov ecx, esi
jmp 0x1001d917
call eax
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_CoFreeUnusedLibraries]
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x1001da9b
call fcn.10001238
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1003c09c
add ebp, 0x20c
leave
ret