Function at 0x100f487
Capabilities:
Create directory
Delete registry value
Get common file path
Persist via contextmenuhandlers registry key
Persist via netsh registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x102a0ec]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x214], 1
call fcn.010253d5
push 0x103
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.0100dd71
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
je 0x100f530
push edi
lea eax, [ebp - 0x210]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x1003a58
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100f530
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1003a3c
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x210]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x10039d8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100f580
push 0x1001340
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1001340
push 1
push edi
push 0x10039d0
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x210]
push eax
push 2
push edi
push 0x1003960
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100f5dd
push 0x1003940
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x1003920
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x1003904
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 4
call fcn.01017179
test eax, eax
je 0x100f621
push edi
push 0x1003940
push 0x10038f0
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push edi
push 0x1003920
push 0x10038f0
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push edi
push 0x1003904
push 0x10038f0
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
jmp 0x100f6ed
mov dword [ebp - 0x21c], edi
xor eax, eax
and word [ebp - 0x234], ax
lea edi, [ebp - 0x218]
stosd dword es:[edi], eax
lea edi, [ebp - 0x232]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
push eax
push 2
push 0
push 0x1003888
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100f67e
push 0x1003870
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x100f6eb
lea eax, [ebp - 0x210]
push eax
push 0x20006
push 0
push 0x10037f8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100f6eb
push 8
lea eax, [ebp - 0x21c]
push eax
push 3
push 0
push 0x10037d4
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
push edi
lea eax, [ebp - 0x210]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x1003770
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100f80d
push 0x100375c
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x100375c
push 1
push edi
push 0x1003754
push dword [ebp - 0x210]
call esi
push 0x100375c
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x100375c
push 1
push edi
push 0x100374c
push dword [ebp - 0x210]
call esi
push 0x1003734
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003734
push 1
push edi
push 0x100372c
push dword [ebp - 0x210]
call esi
push 0x1003714
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003714
push 1
push edi
push 0x1003708
push dword [ebp - 0x210]
call esi
push 0x10036f0
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x10036f0
push 1
push edi
push 0x10036e8
push dword [ebp - 0x210]
call esi
push 0x10036d0
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x10036d0
push 1
push edi
push 0x10036c8
push dword [ebp - 0x210]
call esi
push 0x10036b8
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x10036b8
push 1
push edi
push 0x10036b0
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x210]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x1003600
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100f85d
push 0x10035d0
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x10035d0
push 1
push edi
push 0x10035cc
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x210]
push eax
push 2
push edi
push 0x1003518
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100f8a9
push 0x10034e8
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x10034e8
push 1
push edi
push 0x10035cc
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x210]
push eax
push 1
push edi
push 0x1003488
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100f93e
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push 0x100346c
push dword [ebp - 0x210]
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x218], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100f926
cmp dword [ebp - 0x214], 4
je 0x100f914
cmp dword [ebp - 0x214], 3
jne 0x100f926
xor eax, eax
cmp dword [ebp - 0x224], 1
sete al
mov dword [ebp - 0x220], eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x220], edi
jne 0x100fac8
push edi
push 6
call fcn.01015e93
cmp eax, edi
jne 0x100fac8
push edi
lea eax, [ebp - 0x210]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x10033e0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100fac8
push edi
push edi
push edi
push 5
mov dword [ebp - 0x220], 0x7d
call fcn.01018dae
test eax, eax
je 0x100f9a6
push 0xb54
push 5
call fcn.01015e93
test eax, eax
je 0x100f9a6
mov dword [ebp - 0x220], 0x9c
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x220]
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x100f9ee
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x10033d4
push dword [ebp - 0x210]
call esi
push 0x1003378
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003378
push 1
push edi
push 0x1003364
push dword [ebp - 0x210]
call esi
push 0x1003350
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003350
push 1
push edi
push 0x1003344
push dword [ebp - 0x210]
call esi
push 0x1001780
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1001780
push 1
push edi
push 0x1003328
push dword [ebp - 0x210]
call esi
push 0x1003320
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003320
push 1
push edi
push 0x1003300
push dword [ebp - 0x210]
call esi
push 0x10032e0
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x10032e0
push 1
push edi
push 0x10032cc
push dword [ebp - 0x210]
call esi
push 0x1003320
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003320
push 1
push edi
push 0x10032b0
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100fad7
push 0x10033e0
push 0x80000002
call fcn.01017d6c
push 1
call fcn.0100f2e5
call fcn.0100d538
lea eax, [ebp - 0x210]
push eax
push 1
push edi
push 0x1001c94
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100fb69
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push 0x100328c
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100fb5d
cmp dword [ebp - 0x214], 1
jne 0x100fb5d
lea eax, [ebp - 0x20c]
push eax
call fcn.01018429
test eax, eax
jne 0x100fb5d
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.010190e9
test eax, eax
je 0x100fbb0
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push 0x1003280
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push edi
push 1
push 5
call fcn.01018dae
test eax, eax
je 0x100fd41
push edi
lea eax, [ebp - 0x210]
push eax
push edi
push 3
push edi
push edi
push edi
push 0x1003218
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100fc0f
push 0x10031c8
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x10031c8
push 1
push edi
push edi
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x210]
push eax
push edi
push 3
push edi
push edi
push edi
push 0x1003160
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100fc5b
push 0x10031c8
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x10031c8
push 1
push edi
push edi
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x210]
push eax
push edi
push 3
push edi
push edi
push edi
push 0x10030d8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100fd41
push 0x1003060
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.0100c535
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x10031c8
push dword [ebp - 0x210]
call esi
push 0x1002ff0
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.0100c535
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1002fa0
push dword [ebp - 0x210]
call esi
push 0x1002f28
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.0100c535
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1002ed8
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.01019582
fcomp qword [0x10026d0]
fnstsw ax
test ah, 1
jne 0x100fe29
lea eax, [ebp - 0x210]
push eax
push 1
push edi
push 0x1002e60
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100fe29
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push edi
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100fe1d
cmp dword [ebp - 0x214], 1
jne 0x100fe1d
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
mov ebx, 0x1002e44
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
add esp, 0xc
test eax, eax
jne 0x100fe1d
push 0x103
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x100fe1d
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push ebx
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
push edi
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.01019a5b
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x210]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1002d80
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100fea2
mov dword [ebp - 0x218], 0x20
call fcn.01019582
fcomp qword [0x10026d0]
fnstsw ax
test ah, 5
jp 0x100fe85
push 4
lea eax, [ebp - 0x218]
push eax
push 4
push edi
push 0x1002d58
push dword [ebp - 0x210]
call esi
jmp 0x100fe96
push 0x1002d58
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101672d
leave
ret