Function at 0x10029805
Capabilities:
Persist via ginadll registry key
Query or enumerate registry key

Disassembly:
push ebp
sub esp, 0x584
lea ebp, [esp - 4]
mov eax, dword [0x10113a30]
xor eax, ebp
mov dword [ebp + 0x584], eax
push 0x38
mov eax, 0x100be294
call fcn.10092efa
call fcn.1006f7ae
push eax
lea ecx, [ebp - 0x10]
call fcn.10004d63
xor ebx, ebx
push 0x103
lea eax, [ebp + 0x101]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp + 0x100], bl
call fcn.1008ef90
push 0xfe
lea eax, [ebp + 0x205]
push ebx
push eax
mov dword [ebp - 0x20], 0x104
mov dword [ebp - 0x18], ebx
mov byte [ebp + 0x204], bl
call fcn.1008ef90
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x14], 0xf003f
call fcn.10009e6a
mov esi, pe_nt_image_headers32
push esi
lea eax, [ebp + 0x404]
push ebx
push eax
call fcn.1008ef90
push esi
lea eax, [ebp + 0x304]
push ebx
push eax
call fcn.1008ef90
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x34
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonRalink
lea eax, [ebp + 0x404]
push eax
call esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
lea eax, [ebp + 0x304]
push eax
call esi
cmp dword [ebp - 0x24], 0x18
jne 0x100298d9
mov dword [ebp - 0x14], 0xf013f
push dword [ebp - 0x14]
lea eax, [ebp + 0x404]
push eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call fcn.10008ce6
add esp, 0xc
test eax, eax
je 0x10029923
lea eax, [ebp + 0x404]
push eax
lea eax, [ebp + 0x504]
push str.RegOpenKeyEx__hs_failed_n
push eax
call fcn.1008e5f7
lea eax, [ebp + 0x504]
push eax
push 1
call fcn.1000926a
add esp, 0x14
jmp 0x10029ab6
lea eax, [ebp - 0x10]
push 0x100ce2b8
push eax
call fcn.10005cfd
mov eax, dword [ebp - 0x10]
mov edi, dword [eax - 0xc]
pop ecx
pop ecx
push edi
lea ecx, [ebp - 0x10]
call fcn.10005348
push dword [ebp - 0x14]
push edi
push 1
push eax
push str.SSOEnable
lea eax, [ebp + 0x404]
push eax
push esi
call fcn.1000a248
add esp, 0x1c
cmp eax, 1
je 0x10029985
lea eax, [ebp + 0x504]
push str.RaSetRegValue_REGSTR_SSO_ENABLE_failed_n
push eax
call fcn.1008e5f7
lea eax, [ebp + 0x504]
push eax
push 1
call fcn.1000926a
add esp, 0x10
lea eax, [ebp - 0x10]
push 0x100cdb5f
push eax
call fcn.10005cfd
mov eax, dword [ebp - 0x10]
mov edi, dword [eax - 0xc]
pop ecx
pop ecx
push edi
lea ecx, [ebp - 0x10]
call fcn.10005348
push dword [ebp - 0x14]
push edi
push 1
push eax
push str.CurProfile
lea eax, [ebp + 0x404]
push eax
push esi
call fcn.1000a248
add esp, 0x1c
cmp eax, 1
je 0x100299e7
lea eax, [ebp + 0x504]
push str.RaSetRegValue_REGSTR_KEY_CURPROFILE_failed_n
push eax
call fcn.1008e5f7
lea eax, [ebp + 0x504]
push eax
push 1
call fcn.1000926a
add esp, 0x10
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x100]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x18], ebx
je 0x10029ab6
xor edi, edi
cmp dword [ebp - 0x18], ebx
jbe 0x10029ab6
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push edi
push ebx
mov dword [ebp - 0x1c], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10029aac
lea eax, [ebp + 0x204]
push 0x100cdb5f
push eax
call fcn.1008e4f0
lea eax, [ebp]
push eax
lea eax, [ebp + 0x204]
push eax
call fcn.1008e500
lea eax, [ebp]
push eax
lea eax, [ebp + 0x404]
push eax
push esi
call fcn.1000b336
add esp, 0x1c
cmp eax, 1
je 0x10029aac
lea eax, [ebp + 0x504]
push str.RaDelRegValue_REGSTR_SSO_ENABLE_failed_n
push eax
call fcn.1008e5f7
lea eax, [ebp + 0x504]
push eax
push 1
call fcn.1000926a
add esp, 0x10
inc edi
cmp edi, dword [ebp - 0x18]
jb 0x10029a2e
push str.GinaDLL
lea eax, [ebp + 0x304]
push eax
push esi
call fcn.1000b336
add esp, 0xc
cmp eax, 1
je 0x10029af9
lea eax, [ebp + 0x304]
push eax
lea eax, [ebp + 0x504]
push str.RaDelRegValue__hs_failed_n
push eax
call fcn.1008e5f7
lea eax, [ebp + 0x504]
push eax
push 1
call fcn.1000926a
add esp, 0x14
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10001210
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x584]
xor ecx, ebp
call fcn.1008e5e8
add ebp, 0x588
leave
ret
cmp byte [0x1011c700], 0
je 0x10057889
push esi
mov esi, 0x1011c88c
push esi
call fcn.10001272
test eax, eax
pop ecx
je 0x10057888
push esi
call fcn.10001b5e
test eax, eax
pop ecx
je 0x10057888
mov ecx, dword [0x1011cc1c]
pop esi
jmp 0x10029805
pop esi
ret