Function at 0x100027c9
Capabilities:
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x10005004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
xor ebx, ebx
lea eax, [ebp - 0x310]
mov esi, ecx
mov edi, edx
push ebx
push eax
mov dword [ebp - 0x33c], esi
call sub.msvcrt.dll_memset
push 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x334], ebx
lea eax, [ebp - 0x310]
mov dword [ebp - 0x318], ebx
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x32c], ebx
push 0x104
push eax
push dword [0x10005334]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_0.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push ebx
lea eax, [ebp - 0x330]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x100011c4
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExA]
test eax, eax
jne 0x10002c60
lea edx, [ebp - 0x310]
lea ecx, [ebp - 0x20c]
call fcn.100019e6
mov ebx, eax
mov dword [ebp - 0x314], ebx
test ebx, ebx
je 0x100028bc
push ecx
lea eax, [ebp - 0x310]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x20c]
call fcn.100017b1
xor ecx, ecx
lea eax, [ebp - 0x324]
push ecx
push eax
push ecx
push 0x2001f
push ecx
push ecx
push ecx
push esi
push dword [ebp - 0x330]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x10002c2c
mov ecx, dword [ebp - 0x324]
xor edx, edx
push 1
push eax
push dword [ebp - 0x33c]
call fcn.100025d8
mov esi, eax
test esi, esi
jne 0x10002bf1
mov ecx, dword [ebp - 0x324]
xor ebx, ebx
cmp dword [ebp - 0x314], ebx
mov edx, 0x1000134c
setne bl
inc ebx
push ebx
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.100025d8
mov esi, eax
test esi, esi
jne 0x10002beb
test edi, edi
je 0x10002962
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x10002962
mov ecx, dword [ebp - 0x324]
mov edx, 0x100011dc
push 1
push esi
push edi
call fcn.100017b3
mov esi, eax
test esi, esi
jne 0x10002beb
xor edi, edi
lea eax, [ebp - 0x334]
push edi
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x10001354
push dword [ebp - 0x324]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x10002beb
push dword [ebp - 0x314]
mov ecx, dword [ebp - 0x334]
lea edx, [ebp - 0x20c]
call fcn.1000266e
push dword [ebp - 0x334]
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
jne 0x10002beb
push edi
lea eax, [ebp - 0x318]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100012e0
push dword [ebp - 0x324]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x10002beb
lea ecx, [ebp - 0x320]
mov dword [ebp - 0x320], edi
call fcn.10001885
test eax, eax
je 0x10002a16
cmp dword [ebp - 0x320], 5
jb 0x10002a16
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x10001360
jmp 0x10002a23
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x10001384
mov ecx, dword [ebp - 0x318]
xor edx, edx
call fcn.100025d8
push dword [ebp - 0x318]
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x318], ebx
test esi, esi
jne 0x10002beb
push ebx
lea eax, [ebp - 0x328]
mov edi, 0x2001f
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push 0x100013a8
push dword [ebp - 0x324]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x10002beb
lea eax, [ebp - 0x338]
push eax
push edi
push ebx
push 0x100013b0
push 0x80000000
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
mov esi, 0x103
test eax, eax
jne 0x10002afe
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], esi
push eax
lea eax, [ebp - 0x108]
mov byte [ebp - 5], bl
push eax
lea eax, [ebp - 0x320]
push eax
push ebx
push ebx
push dword [ebp - 0x338]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x10002af2
push dword [ebp - 0x31c]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x320]
push ebx
push 0x100012cc
push dword [ebp - 0x328]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExA]
push dword [ebp - 0x338]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [ebp - 0x318]
push eax
push edi
push ebx
push 0x100013c4
push 0x80000000
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x10002b86
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], esi
push eax
lea eax, [ebp - 0x108]
mov byte [ebp - 5], bl
push eax
lea eax, [ebp - 0x320]
push eax
push ebx
push ebx
push dword [ebp - 0x318]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x10002b7a
push dword [ebp - 0x31c]
lea eax, [ebp - 0x108]
mov dword [ebp - 0x32c], 1
push eax
push dword [ebp - 0x320]
push ebx
push 0x100013e0
push dword [ebp - 0x328]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExA]
push dword [ebp - 0x318]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], esi
push eax
lea eax, [ebp - 0x108]
mov byte [ebp - 5], bl
push eax
lea eax, [ebp - 0x320]
push eax
push ebx
push ebx
push dword [ebp - 0x330]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x10002bdf
push dword [ebp - 0x31c]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x320]
push ebx
push 0x100013e8
push dword [ebp - 0x328]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExA]
mov esi, eax
push dword [ebp - 0x328]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ebx, dword [ebp - 0x314]
push dword [ebp - 0x324]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov edi, dword [ebp - 0x32c]
test esi, esi
jne 0x10002c32
test edi, edi
jne 0x10002c32
call fcn.100017f8
test eax, eax
jne 0x10002c32
mov ecx, dword [ebp - 0x330]
xor edx, edx
push 1
push eax
push dword [ebp - 0x33c]
call fcn.100025d8
jmp 0x10002c32
mov edi, dword [ebp - 0x32c]
push dword [ebp - 0x330]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
jne 0x10002c60
test edi, edi
jne 0x10002c60
call fcn.100017f8
test eax, eax
jne 0x10002c60
push ebx
lea edx, [ebp - 0x20c]
mov ecx, 0x80000000
call fcn.1000266e
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100035c0
mov esp, ebp
pop ebp
ret