Function at 0x100129d0
Capabilities:
Get common file path
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov byte [ebp - 0x38], 0
lea eax, [ebp - 0x1c]
push eax
push 0x10142704
push 0
push 0xf003f
push 0
push 0
push 0
push 0x100ff660
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [0x101422e0], eax
cmp dword [0x101422e0], 0
je 0x10012a2c
push 0x10007
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10012d81
push 1
lea eax, [ebp - 0x38]
push eax
push 3
push 0
push str.Start
mov eax, dword [0x10142704]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x101422e0], eax
cmp dword [0x101422e0], 0
je 0x10012a70
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10012d81
push 0x100ff698
lea eax, [ebp - 0x18]
push eax
call fcn.1001bc30
add esp, 8
lea eax, [ebp - 0x18]
push eax
call fcn.1001bd20
add esp, 4
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push str.StaticVxD
mov eax, dword [0x10142704]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x101422e0], eax
cmp dword [0x101422e0], 0
je 0x10012ad0
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10012d81
push 0x100ff6b0
lea eax, [ebp - 0x18]
push eax
call fcn.1001bc30
add esp, 8
lea eax, [ebp - 0x18]
push eax
call fcn.1001bd20
add esp, 4
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push str.Version
mov eax, dword [0x10142704]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x101422e0], eax
cmp dword [0x101422e0], 0
je 0x10012b30
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10012d81
push 2
call fcn.10011d08
add esp, 4
cmp eax, 2
jne 0x10012b4f
mov dword [ebp - 0x20], 2
jmp 0x10012b56
mov dword [ebp - 0x20], 1
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push 0
push str.HWType
mov eax, dword [0x10142704]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x101422e0], eax
cmp dword [0x101422e0], 0
je 0x10012b9a
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10012d81
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10142708], eax
cmp dword [0x10142708], 0
jne 0x10012bcb
push 1
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10012d81
push str.GetDateFormatA
mov eax, dword [0x10142708]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10142700], eax
cmp dword [0x10142700], 0
jne 0x10012c02
push 2
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10012d81
push 0x14
lea eax, [ebp - 0x34]
push eax
push str.MMMM_d___yyyy
push 0
push 0
push 0x409
call dword [0x10142700]
mov dword [ebp - 4], eax
mov eax, dword [0x10142708]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x10012c54
push 0x2001000
call fcn.1000427e
add esp, 4
push 3
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10012d81
cmp dword [ebp - 4], 0
jne 0x10012c72
push 6
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10012d81
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1001bc30
add esp, 8
lea eax, [ebp - 0x18]
push eax
call fcn.1001bd20
add esp, 4
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push str.Date
mov eax, dword [0x10142704]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x101422e0], eax
cmp dword [0x101422e0], 0
je 0x10012cd1
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10012d81
push 0x200
push 0x10142500
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100ff700
push 0x10142500
call fcn.1001bc40
add esp, 8
push 0x10142500
call fcn.1001bd20
add esp, 4
inc eax
push eax
push 0x10142500
push 1
push 0
push 0x100ff70c
mov eax, dword [0x10142704]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x101422e0], eax
cmp dword [0x101422e0], 0
je 0x10012d45
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10012d81
mov eax, dword [0x10142704]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x101422e0], eax
cmp dword [0x101422e0], 0
je 0x10012d7a
push 0x10002
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x10012d81
xor eax, eax
jmp 0x10012d81
pop edi
pop esi
pop ebx
leave
ret