Function at 0x100371c
Capabilities:
Create thread
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set environment variable

Disassembly:
sub esp, 0x98
push ebx
push edi
xor ebx, ebx
push 0x52
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1003761
push 0x1001dcc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x1003761
push 0x1001dbc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1003761
push 0xffffffffffffffff
call eax
push ebp
push esi
mov esi, 0x1001d8c
push esi
call fcn.010020c7
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebp, eax
cmp ebp, ebx
je 0x1003789
push 0x10013f8
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
push ebp
call edi
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call esi
push 0x1001d60
call fcn.010020c7
mov ebp, 0x1001d38
push ebp
mov dword [esp + 0x1c], eax
call fcn.010020c7
push 0x1001d08
mov dword [esp + 0x14], eax
call fcn.010020c7
push ebx
push ebp
mov dword [esp + 0x38], eax
call esi
mov ebp, dword [esp + 0x18]
cmp ebp, ebx
je 0x10037e5
push ebx
push 0x1001d60
call esi
push ebp
call fcn.01003168
push ebp
call edi
cmp dword [esp + 0x10], ebx
je 0x1003a52
cmp dword [esp + 0x10], ebx
je 0x1003831
mov ebp, dword [sym.imp.ntdll.dll_wcscmp]
push 0x10013f8
push dword [esp + 0x14]
call ebp
test eax, eax
pop ecx
pop ecx
je 0x1003813
push 0x1001d04
push dword [esp + 0x14]
call ebp
test eax, eax
pop ecx
pop ecx
jne 0x1003831
push dword [esp + 0x30]
call fcn.01002983
push 0x1001d04
push dword [esp + 0x14]
call ebp
test eax, eax
pop ecx
pop ecx
je 0x1003a52
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push 0x1001360
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003881
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x44]
push eax
push ebx
push 0x1001cec
push dword [esp + 0x28]
mov dword [esp + 0x3c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x34], ebx
je 0x1003897
push 1
push ebx
push 1
push ebx
push str.grpconv.exe__p
call fcn.010022ab
push 0x1001cc4
call fcn.010020c7
push 0x1001c9c
mov dword [esp + 0x2c], eax
call fcn.010020c7
mov ebp, 0x1001c6c
push ebp
mov dword [esp + 0x1c], eax
call fcn.01002772
push ebx
push 0x1001cc4
mov dword [esp + 0x24], eax
call esi
push ebx
push 0x1001c9c
call esi
push ebx
push ebp
call esi
call fcn.010029b2
mov esi, eax
call fcn.01002c23
call fcn.01002d59
test eax, eax
je 0x100391e
cmp dword [esp + 0x1c], ebx
je 0x10038f4
xor esi, esi
inc esi
push 0x1001c50
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebp, eax
cmp ebp, ebx
je 0x100391e
push 0x1001c38
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1003917
call eax
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, ebx
je 0x100394c
call fcn.0100269b
push 1
push esi
push dword [esp + 0x20]
push dword [esp + 0x34]
call fcn.01002fda
push esi
push dword [esp + 0x20]
call fcn.0100327d
call fcn.01003377
mov dword [esp + 0x38], eax
jmp 0x1003974
call fcn.01003377
mov dword [esp + 0x38], eax
call fcn.0100269b
push 1
push ebx
push dword [esp + 0x20]
push dword [esp + 0x34]
call fcn.01002fda
push ebx
push dword [esp + 0x20]
call fcn.0100327d
push esi
call fcn.01002dd0
push dword [esp + 0x28]
call edi
push dword [esp + 0x18]
call edi
push dword [esp + 0x1c]
call edi
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call sub.USER32.dll_LoadRemoteFonts
push dword [esp + 0xac]
call fcn.010032c2
lea eax, [esp + 0x40]
push eax
push ebx
lea eax, [esp + 0x40]
push eax
push 0x10028d9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0x493e0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push 0x10012e8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003a52
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x44]
push eax
push ebx
push 0x1001c10
push dword [esp + 0x28]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x3c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x2c], ebx
je 0x1003a48
push 0x1001bf4
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x54]
push eax
call fcn.010022ab
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1006124]
cmp eax, ebx
pop esi
pop ebp
je 0x1003a78
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x1006124]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1006124], ebx
push dword [esp + 8]
call edi
push dword [esp + 0x28]
call edi
cmp dword [esp + 0x18], ebx
pop edi
pop ebx
je 0x1003a96
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
add esp, 0x98
ret 0x10