Function at 0x10003dc0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
mov eax, dword [0x10036014]
xor eax, esp
mov dword [esp + 0x240], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [esp + 0x30], eax
mov edi, edx
xor eax, eax
mov dword [esp + 0x18], edi
mov word [esp + 0x10], ax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], ecx
push eax
push 0
push 0xf003f
push 0
lea eax, [esp + 0x24]
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10003e37
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
and al, 4
movzx eax, al
neg eax
push 0xffffffffffffffff
sbb eax, eax
and eax, esi
mov dword [esp + 0x28], eax
call dword [sym.imp.SETUPAPI.dll_CMP_WaitNoPendingInstallEvents]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
lea ebx, [ebx]
push dword [esp + 0x24]
push dword [esp + 0x2c]
push edi
push ecx
push dword [esp + 0x2c]
push 0
call fcn.10029030
mov esi, eax
mov ecx, dword [0x100368b0]
cmp ecx, 0x100368b0
je 0x10003ea4
push esi
push dword [ecx + 0x14]
mov edx, 0x1002fd70
push dword [ecx + 0x10]
mov ecx, 0x11
call fcn.10001da0
mov ecx, dword [0x100368b0]
add esp, 0xc
test esi, esi
jne 0x10003ff5
cmp ecx, 0x100368b0
je 0x10003eca
push dword [ecx + 0x14]
mov edx, 0x1002fd70
push dword [ecx + 0x10]
lea ecx, [esi + 0x14]
call fcn.10001d00
add esp, 8
xor edi, edi
lea esp, [esp]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
call fcn.10003cb0
mov esi, eax
test esi, esi
je 0x10003f10
cmp esi, 3
jne 0x10003eef
cmp edi, 0xa
ja 0x10003f10
jmp 0x10003f00
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10003efe
cmp eax, 1
jne 0x10003f10
jmp 0x10003f00
xor esi, esi
push 0x3e8
call ebx
inc edi
cmp edi, 0xb4
jb 0x10003ed0
push 0xbb8
call ebx
push 0xffffffffffffffff
call dword [sym.imp.SETUPAPI.dll_CMP_WaitNoPendingInstallEvents]
mov eax, dword [0x100368b0]
cmp eax, 0x100368b0
je 0x10003f49
push esi
push dword [eax + 0x14]
mov edx, 0x1002fd70
mov ecx, 0x15
push dword [eax + 0x10]
call fcn.10001da0
mov eax, dword [0x100368b0]
add esp, 0xc
test esi, esi
je 0x1000407b
mov dword [esp + 0x2c], 0
cmp eax, 0x100368b0
je 0x10003f78
push dword [eax + 0x14]
mov edx, 0x1002fd70
mov ecx, 0x16
push dword [eax + 0x10]
call fcn.10001d00
add esp, 8
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x30]
mov edx, Ordinal_3
push eax
mov ecx, edi
call fcn.10004270
cmp dword [esp + 0x1c], 0
jne 0x10004059
cmp esi, 0x5df
jne 0x10004059
mov eax, dword [esp + 0x14]
cmp eax, 0xc
jne 0x10004069
mov ecx, dword [ebp + 8]
test cl, 0x20
jne 0x10004075
or ecx, 0x20
mov dword [ebp + 8], ecx
mov eax, dword [0x100368b0]
cmp eax, 0x100368b0
je 0x10003e60
push dword [eax + 0x14]
mov edx, 0x1002fd70
mov ecx, 0x17
push dword [eax + 0x10]
call fcn.10001d00
add esp, 8
jmp 0x10003e57
cmp esi, 0xb7
jne 0x1000401f
xor esi, esi
cmp ecx, 0x100368b0
je 0x1000407b
push dword [ecx + 0x14]
mov edx, 0x1002fd70
push dword [ecx + 0x10]
lea ecx, [esi + 0x12]
call fcn.10001d00
add esp, 8
jmp 0x1000407b
cmp esi, 0x12f
jne 0x1000404e
mov esi, 0xfa3f
cmp ecx, 0x100368b0
je 0x1000407b
push dword [ecx + 0x14]
mov edx, 0x1002fd70
push dword [ecx + 0x10]
mov ecx, 0x13
call fcn.10001d00
add esp, 8
jmp 0x1000407b
xor edx, edx
mov ecx, esi
call fcn.1000c0f0
mov esi, eax
test esi, esi
je 0x1000407b
cmp esi, 0x5df
jne 0x1000407b
mov eax, dword [esp + 0x14]
cmp eax, 0x26
jne 0x10004075
mov esi, 0xfa3f
jmp 0x1000407b
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov ecx, dword [esp + 0x24c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10011ed6
mov esp, ebp
pop ebp
ret 0x10