Function at 0x1001aa7
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x100b2d0]
push edi
push pe_nt_image_headers32
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
mov byte [ebp - 0x108], 0
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push pe_nt_image_headers32
pop ecx
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0x20c], 0
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x21c]
push eax
xor edi, edi
lea eax, [ebp - 0x214]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
mov dword [ebp - 0x218], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001ce4
push ebx
push esi
mov dword [ebp - 0x210], edi
mov esi, 0x100b2e0
mov ebx, 0xc8
push dword [ebp - 0x210]
push str.wextract_cleanup_d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push edi
push edi
push edi
push esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001b70
inc dword [ebp - 0x210]
cmp dword [ebp - 0x210], ebx
jl 0x1001b32
cmp dword [ebp - 0x210], ebx
jne 0x1001b90
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x100b2e0], 0
jmp 0x1001ce2
mov ebx, dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call ebx
push 0x1001298
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010066cf
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
cmp eax, edi
mov dword [ebp - 0x210], eax
je 0x1001c1a
push 0x1001288
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push dword [ebp - 0x210]
mov edi, eax
neg edi
sbb edi, edi
neg edi
mov dword [ebp - 0x218], edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
test edi, edi
je 0x1001c1a
push esi
lea eax, [ebp - 0x108]
push eax
call ebx
test eax, eax
je 0x1001c32
push 0x1001271
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.010066cf
jmp 0x1001c32
push esi
lea eax, [ebp - 0x108]
push eax
push dword [0x100c4a4]
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x1001c70
mov esi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edi, 0x100bc44
push edi
call esi
mov ebx, eax
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebx + eax + 0x50]
push eax
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov ebx, eax
xor eax, eax
cmp ebx, eax
jne 0x1001c7e
push eax
push 0x10
push eax
push eax
push 0x4b5
push eax
call fcn.01003ebe
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001ce2
xor ecx, ecx
cmp dword [ebp - 0x218], eax
sete cl
cmp dword [ebp - 0x218], eax
mov eax, str.rundll32.exe__sadvpack.dll_DelNodeRunDLL32___s_
mov dword [0x100b330], ecx
jne 0x1001ca1
mov eax, str._s__D:_s
push edi
lea ecx, [ebp - 0x108]
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push ebx
call esi
inc eax
push eax
push ebx
push 1
push 0
push 0x100b2e0
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.010064de
leave
ret