Function at 0x1007f14
Capabilities:
Persist via run registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x101203c]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x224], eax
push 0x41
xor eax, eax
xor edx, edx
pop ecx
lea edi, [ebp - 0x208]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
sub eax, edx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x20c], edx
mov dword [esi], edx
je 0x100839a
dec eax
je 0x1008226
dec eax
je 0x100801e
dec eax
je 0x1007f99
dec eax
je 0x100801e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100d058
leave
ret 0x18
push ebx
push 9
call fcn.01007ebf
test eax, eax
je 0x10084d9
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.01007e6e
test eax, eax
je 0x10084d9
push ebx
call fcn.01007ddd
test eax, eax
jl 0x10084d9
mov eax, 0xfa
sub eax, dword [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x3f8
push dword [0x1016cac]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x20c]
mov ecx, 0x104
push 0x1005930
sub ecx, eax
push ecx
add ebx, eax
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x10
or dword [esi], 1
jmp 0x10084d9
push ebx
push 0x1a
call fcn.01007ebf
test eax, eax
mov esi, 0x104
jne 0x100814c
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
xor eax, eax
push eax
push 0x2001f
push eax
push eax
push eax
push 0x1002358
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10084d9
lea eax, [ebp - 0x20c]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
push 0
mov edi, 0x100239c
push edi
push dword [ebp - 0x214]
mov dword [ebp - 0x20c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10080e2
cmp dword [ebp - 0x21c], 2
jne 0x10080da
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebp - 0x20c], eax
mov edi, ecx
test edi, edi
je 0x1008138
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x20c], eax
jmp 0x1008138
dec dword [ebp - 0x20c]
jmp 0x1008135
push esi
push 0x10166cc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, esi
sub ecx, eax
push ecx
mov dword [ebp - 0x20c], eax
add eax, ebx
push eax
push 0x3eb
push dword [0x1016cac]
call dword [sym.imp.USER32.dll_LoadStringA]
add dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
inc eax
push eax
push ebx
push 1
push 0
push edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edi, edi
inc edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x10084d9
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.01007e6e
test eax, eax
je 0x10084d9
mov eax, dword [ebp - 0x20c]
mov ecx, esi
sub ecx, eax
push ecx
push 0x1005374
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
add dword [ebp - 0x20c], 0x29
push ebx
call fcn.01007ddd
test eax, eax
jl 0x10084d9
mov eax, 0xff
sub eax, dword [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
xor eax, eax
cmp dword [ebp + 8], 2
setne al
add eax, 0x3f0
push eax
push dword [0x1016cac]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x20c]
mov ecx, esi
push 0x100591c
sub ecx, eax
push ecx
add ebx, eax
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov eax, dword [ebp - 0x218]
or dword [eax], 1
add esp, 0x10
cmp dword [ebp + 8], 2
jne 0x10084d9
cmp dword [ebp + 0xc], 0
je 0x10084d9
push 0
push esi
push dword [ebp - 0x220]
push 0x10022d4
call fcn.01006b0a
test eax, eax
je 0x10084d9
mov eax, dword [ebp - 0x218]
or dword [eax], 2
jmp 0x10084d9
push ebx
push edx
call fcn.01007ebf
test eax, eax
mov esi, 0x104
jne 0x10082f5
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push 0x1002358
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10084d9
lea eax, [ebp - 0x20c]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
xor edi, edi
push edi
push 0x10053f0
push dword [ebp - 0x214]
mov dword [ebp - 0x20c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10082dd
cmp dword [ebp - 0x21c], 2
jne 0x10082cd
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [ebp - 0x20c], eax
cmp ecx, edi
mov dword [ebp - 0x210], ecx
je 0x10082dd
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x10082d3
dec dword [ebp - 0x20c]
mov dword [ebp - 0x210], 1
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x210], edi
je 0x10084d9
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.01007e6e
test eax, eax
je 0x10084d9
push ebx
call fcn.01007ddd
test eax, eax
jl 0x10084d9
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov eax, 0xff
sub eax, dword [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x3ef
push dword [0x1016cac]
call edi
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x20c]
mov ecx, esi
push 0x100591c
sub ecx, eax
push ecx
add ebx, eax
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov eax, dword [ebp - 0x218]
or dword [eax], 1
add esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x10084d9
push 0xff
push dword [ebp - 0x224]
push 0x40e
push dword [0x1016cac]
call edi
mov eax, dword [ebp - 0x218]
or dword [eax], 4
jmp 0x10081fd
push ebx
push 0x19
call fcn.01007ebf
test eax, eax
mov esi, 0x104
jne 0x1008470
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x1002358
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10084d9
lea eax, [ebp - 0x20c]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
xor edi, edi
push edi
push 0x10053f8
push dword [ebp - 0x214]
mov dword [ebp - 0x20c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100845c
cmp dword [ebp - 0x21c], 2
jne 0x100844c
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [ebp - 0x20c], eax
cmp ecx, edi
mov dword [ebp - 0x210], ecx
je 0x100845c
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x20c], eax
jmp 0x100845c
dec dword [ebp - 0x20c]
mov dword [ebp - 0x210], 1
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x210], edi
je 0x10084d9
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.01007e6e
test eax, eax
je 0x10084d9
push ebx
call fcn.01007ddd
test eax, eax
jl 0x10084d9
mov eax, 0xff
sub eax, dword [ebp - 0x20c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x3ef
push dword [0x1016cac]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x20c]
push 0x100591c
sub esi, eax
add ebx, eax
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
mov eax, dword [ebp - 0x218]
add esp, 0x10
or dword [eax], 1
mov eax, dword [ebp - 0x218]
cmp dword [eax], 0
je 0x1007f88
xor eax, eax
inc eax
jmp 0x1007f8a