Function at 0x100c895
Capabilities:
Delete registry key
Delete registry value
Persist via netsh registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x102a0ec]
push ebx
push esi
push edi
push 4
pop edi
mov dword [ebp - 4], eax
xor eax, eax
inc eax
push 0x1001aa0
mov ebx, 0x80000001
xor esi, esi
push ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push esi
lea eax, [ebp - 0x28]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1001a48
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100c934
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
push 0x1001a28
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100c90c
cmp dword [ebp - 0x30], edi
je 0x100c92b
push edi
lea eax, [ebp - 0x34]
push eax
push edi
push esi
push 0x1001a28
push dword [ebp - 0x28]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x28]
push eax
push 3
push esi
push 0x10019a8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100c973
push edi
lea eax, [ebp - 0x34]
push eax
push edi
push esi
push 0x1001408
push dword [ebp - 0x28]
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x28]
push eax
push 3
push esi
push 0x1001940
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100cb80
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
push 0x100192c
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
jne 0x100c9fa
cmp dword [ebp - 0x30], 1
jne 0x100c9fa
lea eax, [ebp - 0x24]
push 0x1001780
push eax
call ebx
pop ecx
mov edi, eax
pop ecx
neg edi
sbb edi, edi
push esi
inc edi
push edi
push 0x1001918
call fcn.0101ab47
push esi
push edi
push 0x1001904
call fcn.0101ab47
push 0x100192c
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
push 0x10018f0
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100ca6c
cmp dword [ebp - 0x30], 1
jne 0x100ca6c
lea eax, [ebp - 0x24]
push 0x1001780
push eax
call ebx
pop ecx
mov edi, eax
pop ecx
neg edi
sbb edi, edi
push esi
inc edi
push edi
push 0x1001918
call fcn.0101ab47
push esi
push edi
push 0x10018dc
call fcn.0101ab47
push esi
push edi
push 0x1001904
call fcn.0101ab47
push 0x10018f0
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
mov edi, 0x10018c8
push edi
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100cac1
cmp dword [ebp - 0x30], 1
jne 0x100cac1
lea eax, [ebp - 0x24]
push 0x1001780
push eax
call ebx
pop ecx
neg eax
pop ecx
sbb eax, eax
push esi
inc eax
push eax
push 0x10018b4
call fcn.0101ab47
push edi
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
push 0x10018a0
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100cb77
cmp dword [ebp - 0x30], 1
jne 0x100cb77
lea eax, [ebp - 0x24]
push 0x1001780
push eax
call ebx
pop ecx
mov edi, eax
pop ecx
neg edi
sbb edi, edi
push esi
inc edi
push edi
push 0x1001888
call fcn.0101ab47
push esi
push edi
push 0x1001874
call fcn.0101ab47
push esi
push edi
push 0x100185c
call fcn.0101ab47
push esi
push edi
push 0x1001848
call fcn.0101ab47
push esi
push edi
push 0x1001834
call fcn.0101ab47
push esi
push edi
push 0x1001820
call fcn.0101ab47
push esi
push edi
push 0x100180c
call fcn.0101ab47
push esi
push edi
push 0x10017f4
call fcn.0101ab47
push 0x10018a0
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0100c60f
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101672d
leave
ret