Function at 0x102cd76
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8cc
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
cmp edi, esi
mov dword [0x1047500], eax
mov dword [0x1048be8], 2
lea eax, [ebp - 0x2ac]
je 0x102cdc1
push 0x153
push edi
push eax
call dword [sym.imp.msvcrt.dll_mbstowcs]
add esp, 0xc
jmp 0x102cdd1
push 0x1002d58
push 0x154
push eax
call fcn.01028a67
call fcn.010283c0
call fcn.0102ad13
cmp edi, esi
je 0x102d46e
mov edi, dword [sym.imp.msvcrt.dll_wcsstr]
lea eax, [ebp - 0x2ac]
push 0x1005bb4
push eax
call edi
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x2ac]
je 0x102ce1e
push 0x1005b88
push eax
call edi
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
push eax
call fcn.0102d4a1
jmp 0x102d46e
push 0x1005b60
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102cea2
mov dword [ebp - 0x8cc], esi
mov dword [ebp - 0x8c8], esi
call fcn.0102bcdf
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x8c8]
push eax
push 0x20019
push esi
push 0x1005b00
mov ebx, 0x80000002
push ebx
call edi
test eax, eax
je 0x102ce91
lea eax, [ebp - 0x8cc]
push eax
push 3
push esi
push 0x10054d8
push ebx
call edi
test eax, eax
jne 0x102d46e
push 0x1005ad8
push dword [ebp - 0x8cc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x102d088
push dword [ebp - 0x8c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x102d46e
lea eax, [ebp - 0x2ac]
push 0x1005ab0
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102cec0
call fcn.0102c472
jmp 0x102d46e
lea eax, [ebp - 0x2ac]
push 0x1005a88
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102ceec
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
call fcn.0102cb77
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x102d46e
lea eax, [ebp - 0x2ac]
push 0x1005a60
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102cf0b
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push 1
jmp 0x102cedc
call fcn.010288ae
call fcn.0102beb4
call fcn.01035165
lea eax, [ebp - 0x2ac]
push 0x1005a44
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d093
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
lea eax, [ebp - 0x8cc]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x1005a18
push 0x80000000
mov dword [ebp - 0x8cc], esi
call ebx
test eax, eax
jne 0x102d46e
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x24
push 0x10059f4
push 1
push esi
push 0x10059e4
push dword [ebp - 0x8cc]
mov dword [ebp - 0x8c8], esi
call edi
push 0x104
lea eax, [ebp - 0x4b4]
push eax
push 0xa7
push dword [0x1047500]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x102cfd6
lea eax, [ebp - 0x4b4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102cfb0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x4b4]
push eax
push 1
push esi
push esi
push dword [ebp - 0x8cc]
call edi
push esi
lea eax, [ebp - 0x8c8]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x10059d4
push dword [ebp - 0x8cc]
call ebx
test eax, eax
jne 0x102d088
mov ebx, 0x104
push ebx
push ebx
lea eax, [ebp - 0x6bc]
push eax
call fcn.01034382
test eax, eax
je 0x102d07c
push 0x100219c
push ebx
lea eax, [ebp - 0x6bc]
push eax
call fcn.01028adc
test eax, eax
jl 0x102d07c
lea eax, [ebp - 0x6bc]
push eax
push 0x1005978
lea eax, [ebp - 0x8c4]
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
test eax, eax
jl 0x102d07c
lea eax, [ebp - 0x8c4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102d056
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x8c4]
push eax
push 1
push esi
push esi
push dword [ebp - 0x8c8]
call edi
push dword [ebp - 0x8c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x8cc]
jmp 0x102ce97
lea eax, [ebp - 0x2ac]
push 0x1005958
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x102d46e
lea eax, [ebp - 0x2ac]
push 0x1005928
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d0c4
call fcn.0102cacd
lea eax, [ebp - 0x2ac]
push 0x1005910
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d0dd
call fcn.0104354e
lea eax, [ebp - 0x2ac]
push 0x10058f0
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d0fc
push esi
call fcn.010296be
jmp 0x102d46e
lea eax, [ebp - 0x2ac]
push 0x10058e0
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d11f
call fcn.01028547
call fcn.0102870e
jmp 0x102d46e
lea eax, [ebp - 0x2ac]
push 0x10058bc
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d138
call fcn.0102bcdf
lea eax, [ebp - 0x2ac]
push 0x10058a8
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d156
call fcn.01036c1f
jmp 0x102d46e
lea eax, [ebp - 0x2ac]
push 0x1005890
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d17a
call fcn.0103ec7c
push esi
call fcn.01040799
jmp 0x102d46e
lea eax, [ebp - 0x2ac]
push 0x100587c
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d1e2
call fcn.010309f6
test eax, eax
jne 0x102d46e
lea eax, [ebp - 0x2ac]
push 0x1005860
push eax
call edi
test eax, eax
pop ecx
pop ecx
push esi
je 0x102d1b7
call fcn.0102b953
jmp 0x102d1bc
call fcn.0102b6e6
call fcn.0102c5f6
call fcn.0103087c
call fcn.0103ec7c
push esi
push esi
push 0x2000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x102d46e
lea eax, [ebp - 0x2ac]
push 0x100584c
push eax
call edi
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x2ac]
je 0x102d226
push 0x1005860
push eax
call edi
test eax, eax
pop ecx
pop ecx
push 1
je 0x102d213
call fcn.0102b953
jmp 0x102d218
call fcn.0102b6e6
push 1
call fcn.0102fe61
call fcn.0103f44a
jmp 0x102d1cb
push 0x1005828
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d258
call fcn.01036bf2
push esi
push esi
push esi
call fcn.01042037
push esi
push esi
push 0x2000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x102d489
lea eax, [ebp - 0x2ac]
push 0x1005810
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d276
call fcn.0103386a
jmp 0x102d46e
call fcn.0102a0a4
push 1
call fcn.0102a788
call fcn.0102e413
call fcn.0102bcdf
lea eax, [ebp - 0x2ac]
push 0x10057f8
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d2a5
call fcn.0102c463
lea eax, [ebp - 0x2ac]
push 0x10057e4
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d2be
call fcn.01028415
lea eax, [ebp - 0x2ac]
push 0x10057cc
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d313
push 1
call fcn.01027ca8
test eax, eax
je 0x102d2fe
lea eax, [ebp - 0x2ac]
push 0x10057b4
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d2fe
push esi
call fcn.0102f521
call fcn.0102f91e
jmp 0x102d304
push esi
call fcn.0102fe61
call fcn.01029bbf
call fcn.01027dba
call fcn.0102814c
push esi
call fcn.01027ca8
test eax, eax
mov ebx, dword [sym.imp.SHELL32.dll_SHChangeNotify]
je 0x102d32f
push 1
push 1
push esi
call fcn.01042037
jmp 0x102d377
lea eax, [ebp - 0x2ac]
push 0x10057a0
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d347
push esi
push esi
jmp 0x102d327
lea eax, [ebp - 0x2ac]
push 0x1005784
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x102d385
push esi
push esi
push 1
call fcn.01042037
push esi
push esi
push esi
push 5
call fcn.01034068
test eax, eax
je 0x102d377
call fcn.0102b6cb
push esi
push esi
push 0x2000
push 0x8000000
call ebx
push 0x44c
push 0xa28
push 1
push 5
call fcn.01034068
test eax, eax
je 0x102d46e
call fcn.010309f6
test eax, eax
jne 0x102d46e
call fcn.01028820
test eax, eax
jne 0x102d46e
push esi
mov dword [ebp - 0x8c8], esi
call fcn.0102b6e6
call fcn.0103087c
call fcn.0103ec7c
push esi
lea eax, [ebp - 0x8c8]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1004310
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102d460
push 0xff
lea eax, [ebp - 0x4ac]
push eax
call fcn.01033bb5
test eax, eax
je 0x102d454
push 0x1004e6c
push 0x100
lea eax, [ebp - 0x4ac]
push eax
call fcn.01028adc
lea eax, [ebp - 0x4ac]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102d426
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x4ac]
push eax
push 1
push esi
push 0x1004e58
push dword [ebp - 0x8c8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x8c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
push 0x2000
push 0x8000000
call ebx
lea eax, [ebp - 0x2ac]
push eax
push 0x1005764
push 2
call fcn.01036b8b
add esp, 0xc
call fcn.010364c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.01031a01
leave
ret 0x10