Function at 0x1007ef4
Capabilities:
Persist via run registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x101203c]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x224], eax
push 0x41
xor eax, eax
xor edx, edx
pop ecx
lea edi, [ebp - 0x208]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
sub eax, edx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x20c], edx
mov dword [esi], edx
je 0x100837a
dec eax
je 0x1008206
dec eax
je 0x1007ffe
dec eax
je 0x1007f79
dec eax
je 0x1007ffe
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100d038
leave
ret 0x18
push ebx
push 9
call fcn.01007e9f
test eax, eax
je 0x10084b9
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.01007e4e
test eax, eax
je 0x10084b9
push ebx
call fcn.01007dbd
test eax, eax
jl 0x10084b9
mov eax, 0xfa
sub eax, dword [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x3f8
push dword [0x1016cac]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x20c]
mov ecx, 0x104
push 0x100590c
sub ecx, eax
push ecx
add ebx, eax
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x10
or dword [esi], 1
jmp 0x10084b9
push ebx
push 0x1a
call fcn.01007e9f
test eax, eax
mov esi, 0x104
jne 0x100812c
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
xor eax, eax
push eax
push 0x2001f
push eax
push eax
push eax
push 0x1002350
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10084b9
lea eax, [ebp - 0x20c]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
push 0
mov edi, 0x1002394
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x20c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10080c2
cmp dword [ebp - 0x21c], 2
jne 0x10080ba
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebp - 0x20c], eax
mov edi, ecx
test edi, edi
je 0x1008118
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x20c], eax
jmp 0x1008118
dec dword [ebp - 0x20c]
jmp 0x1008115
push esi
push 0x10166cc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, esi
sub ecx, eax
push ecx
mov dword [ebp - 0x20c], eax
add eax, ebx
push eax
push 0x3eb
push dword [0x1016cac]
call dword [sym.imp.USER32.dll_LoadStringA]
add dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
inc eax
push eax
push ebx
push 1
push 0
push edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edi, edi
inc edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x10084b9
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.01007e4e
test eax, eax
je 0x10084b9
mov eax, dword [ebp - 0x20c]
mov ecx, esi
sub ecx, eax
push ecx
push 0x1005350
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add dword [ebp - 0x20c], 0x29
push ebx
jmp section..htext
push 0
push esi
push dword [ebp - 0x220]
push 0x10022cc
call fcn.01006aea
test eax, eax
je 0x10084b9
mov eax, dword [ebp - 0x218]
or dword [eax], 2
jmp 0x10084b9
push ebx
push edx
call fcn.01007e9f
test eax, eax
mov esi, 0x104
jne 0x10082d5
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push 0x1002350
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10084b9
lea eax, [ebp - 0x20c]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
xor edi, edi
push edi
push 0x10053cc
push dword [ebp - 0x214]
mov dword [ebp - 0x20c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10082bd
cmp dword [ebp - 0x21c], 2
jne 0x10082ad
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [ebp - 0x20c], eax
cmp ecx, edi
mov dword [ebp - 0x210], ecx
je 0x10082bd
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x10082b3
dec dword [ebp - 0x20c]
mov dword [ebp - 0x210], 1
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x210], edi
je 0x10084b9
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.01007e4e
test eax, eax
je 0x10084b9
push ebx
call fcn.01007dbd
test eax, eax
jl 0x10084b9
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov eax, 0xff
sub eax, dword [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x3ef
push dword [0x1016cac]
call edi
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x20c]
mov ecx, esi
push 0x10058f8
sub ecx, eax
push ecx
add ebx, eax
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov eax, dword [ebp - 0x218]
or dword [eax], 1
add esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x10084b9
push 0xff
push dword [ebp - 0x224]
push 0x40e
push dword [0x1016cac]
call edi
mov eax, dword [ebp - 0x218]
or dword [eax], 4
jmp 0x10081dd
push ebx
push 0x19
call fcn.01007e9f
test eax, eax
mov esi, 0x104
jne 0x1008450
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x1002350
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10084b9
lea eax, [ebp - 0x20c]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
xor edi, edi
push edi
push 0x10053d4
push dword [ebp - 0x214]
mov dword [ebp - 0x20c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100843c
cmp dword [ebp - 0x21c], 2
jne 0x100842c
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [ebp - 0x20c], eax
cmp ecx, edi
mov dword [ebp - 0x210], ecx
je 0x100843c
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x20c], eax
jmp 0x100843c
dec dword [ebp - 0x20c]
mov dword [ebp - 0x210], 1
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x210], edi
je 0x10084b9
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.01007e4e
test eax, eax
je 0x10084b9
push ebx
call fcn.01007dbd
test eax, eax
jl 0x10084b9
mov eax, 0xff
sub eax, dword [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x3ef
push dword [0x1016cac]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x20c]
push 0x10058f8
sub esi, eax
add ebx, eax
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov eax, dword [ebp - 0x218]
add esp, 0x10
or dword [eax], 1
mov eax, dword [ebp - 0x218]
cmp dword [eax], 0
je 0x1007f68
xor eax, eax
inc eax
jmp 0x1007f6a