Function at 0x1001a73a
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
mov eax, 0x100cca57
call fcn.10030644
sub esp, 0x13c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
push ebx
lea ecx, [ebp - 0x148]
call fcn.10001000
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.autorun
mov dword [ebp - 4], ebx
call fcn.10002736
mov ecx, esi
call fcn.1001b14b
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.autodial
mov dword [ebp - 0x44], eax
call fcn.10002736
mov ecx, esi
call fcn.1001b14b
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.autoredial
mov dword [ebp - 0x4c], eax
call fcn.10002736
mov ecx, esi
call fcn.1001b14b
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.noroute
mov dword [ebp - 0x48], eax
call fcn.10002736
mov ecx, esi
call fcn.1001b14b
push 0x1e
push ecx
mov edi, str.autodialtime
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
mov dword [ebp - 0x38], eax
call fcn.10002736
mov ecx, esi
call fcn.1001b14b
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.autoselect
mov dword [ebp - 0x40], eax
call fcn.10002736
mov ecx, esi
call fcn.1001b14b
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.autosort
mov dword [ebp - 0x34], eax
call fcn.10002736
mov ecx, esi
call fcn.1001b14b
push 1
push 0xd10
mov dword [ebp - 0x30], eax
call fcn.100202d0
pop ecx
pop ecx
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.autoping
call fcn.10002736
mov ecx, esi
call fcn.1001b14b
push 0x1e
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.autolinetime
mov dword [ebp - 0x2c], eax
call fcn.10002736
mov ecx, esi
call fcn.1001b14b
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.autoline
mov dword [ebp - 0x24], eax
call fcn.10002736
mov ecx, esi
call fcn.1001b14b
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.autoclear
mov dword [ebp - 0x28], eax
call fcn.10002736
mov ecx, esi
call fcn.1001b14b
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.nohidden_on_connected
mov dword [ebp - 0x20], eax
call fcn.10002736
mov ecx, esi
call fcn.1001b14b
cmp eax, ebx
push 0xffffffffffffffff
setne al
xor ecx, ecx
cmp al, bl
sete cl
push ecx
mov dword [ebp - 0x1c], ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.method
call fcn.10002736
mov ecx, esi
call fcn.1001b14b
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x3c], eax
call fcn.100bd361
cmp eax, 1
jne 0x1001ab1f
push dword [ebp - 0x44]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.autorun
call fcn.10002736
mov ecx, esi
call fcn.1001b1ff
push dword [ebp - 0x4c]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.autodial
call fcn.10002736
mov ecx, esi
call fcn.1001b1ff
push dword [ebp - 0x48]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.autoredial
call fcn.10002736
mov ecx, esi
call fcn.1001b1ff
push dword [ebp - 0x38]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.noroute
call fcn.10002736
mov ecx, esi
call fcn.1001b1ff
push dword [ebp - 0x40]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push edi
call fcn.10002736
mov ecx, esi
call fcn.1001b1ff
cmp dword [ebp - 0x3c], 4
je 0x1001a980
push dword [ebp - 0x3c]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
jmp 0x1001a988
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.method
call fcn.10002736
mov ecx, esi
call fcn.1001b1ff
cmp dword [ebp - 0x1c], ebx
je 0x1001a9a7
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
jmp 0x1001a9af
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.nohidden_on_connected
call fcn.10002736
mov ecx, esi
call fcn.1001b1ff
push dword [ebp - 0x34]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.autoselect
call fcn.10002736
mov ecx, esi
call fcn.1001b1ff
push dword [ebp - 0x30]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.autosort
call fcn.10002736
mov ecx, esi
call fcn.1001b1ff
push dword [ebp - 0x2c]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.autoping
call fcn.10002736
mov ecx, esi
call fcn.1001b1ff
push dword [ebp - 0x24]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.autolinetime
call fcn.10002736
mov ecx, esi
call fcn.1001b1ff
push dword [ebp - 0x28]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.autoline
call fcn.10002736
mov ecx, esi
call fcn.1001b1ff
push dword [ebp - 0x20]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push str.autoclear
call fcn.10002736
mov ecx, esi
call fcn.1001b1ff
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x15]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.10003536
lea eax, [ebp - 0x10]
push eax
call fcn.10020042
add esp, 0x14
mov ecx, eax
call fcn.10003ab9
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
cmp ecx, ebx
je 0x1001aaa9
call fcn.10002801
cmp esi, ebx
jne 0x1001ab16
cmp dword [ebp - 0x44], ebx
je 0x1001ab01
lea eax, [ebp - 0x10]
mov ecx, 0x10109850
push eax
call fcn.100c6357
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 1
mov ecx, dword [eax - 8]
mov eax, dword [0x10109698]
cmp eax, ebx
je 0x1001aad7
mov esi, dword [eax]
jmp 0x1001aad9
xor esi, esi
lea eax, [ecx + ecx]
lea ecx, [ebp - 0x10]
push eax
push ebx
call fcn.100c14ac
push eax
push 1
push ebx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.100c1067
jmp 0x1001ab16
mov eax, dword [0x10109698]
cmp eax, ebx
je 0x1001ab0c
mov ebx, dword [eax]
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x148]
call fcn.100010ca
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret