Function at 0x1003c9c
Capabilities:
Create thread
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x10060f0]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor ebx, ebx
push 0x52
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x78], ebx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1003cf7
push 0x1001e0c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x78], eax
je 0x1003cf7
push 0x1001dfc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1003cf7
push 0xffffffffffffffff
call eax
push esi
mov esi, 0x1001dcc
push esi
call fcn.0100220c
cmp eax, ebx
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x7c], eax
je 0x1003d21
push 0x1001408
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
push dword [ebp - 0x7c]
call edi
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call esi
push 0x1001da0
call fcn.0100220c
push 0x1001d78
mov dword [ebp - 0x6c], eax
call fcn.0100220c
push 0x1001d48
mov dword [ebp - 0x70], eax
call fcn.0100220c
push ebx
push 0x1001d78
mov dword [ebp - 0x7c], eax
call esi
cmp dword [ebp - 0x6c], ebx
je 0x1003d7d
push ebx
push 0x1001da0
call esi
push dword [ebp - 0x6c]
call fcn.01003280
push dword [ebp - 0x6c]
call edi
cmp dword [ebp - 0x70], ebx
je 0x100400b
cmp dword [ebp - 0x70], ebx
je 0x1003dca
push 0x1001408
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x1003daa
push 0x1001d44
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x1003dca
push dword [ebp - 0x7c]
call fcn.01002c90
push 0x1001d44
push dword [ebp - 0x70]
call dword [sym.imp.ntdll.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x100400b
lea eax, [ebp - 0x74]
push eax
push 0x20019
push ebx
push 0x1001370
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003e1f
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0xa0]
push eax
push ebx
push 0x1001d2c
push dword [ebp - 0x74]
mov dword [ebp - 0x88], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x8c], ebx
je 0x1003e37
push 1
push ebx
push 1
push ebx
push str.grpconv.exe__p
call fcn.01002454
push 0x1001d04
call fcn.0100220c
push 0x1001cdc
mov dword [ebp - 0x80], eax
call fcn.0100220c
push 0x1001cac
mov dword [ebp - 0x84], eax
call fcn.010029c5
push ebx
push 0x1001d04
mov dword [ebp - 0x6c], eax
call esi
push ebx
push 0x1001cdc
call esi
push ebx
push 0x1001cac
call esi
call fcn.01002cc9
mov esi, eax
jmp 0x100d51e
mov eax, dword [0x100613c]
cmp eax, ebx
pop esi
je 0x1004030
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x100613c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100613c], ebx
push dword [ebp - 0x70]
call edi
push dword [ebp - 0x7c]
call edi
cmp dword [ebp - 0x78], ebx
pop edi
pop ebx
je 0x100404a
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.01004e6a
leave
ret 0x10