Function at 0x101976e
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x102a0ec]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x208], esi
jne 0x10197aa
mov eax, 0x80004003
jmp 0x1019a49
push 0x28
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0x20c], eax
jne 0x10197c6
mov eax, 0x8007000e
jmp 0x1019a49
push ebx
push edi
lea eax, [ebp - 0x208]
push eax
push 2
push esi
push 0x1006438
mov ebx, 0x80000001
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1019862
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0x214], eax
je 0x1019856
mov edi, 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x101984a
push 0x1006a74
push edi
push dword [ebp - 0x214]
call fcn.0100d4ff
push dword [ebp - 0x214]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x214]
push 1
push esi
push 0x1006a54
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x214]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1006a44
push 0x10069d8
lea eax, [ebp - 0x204]
push 0xff
push eax
call fcn.0100d4d1
add esp, 0x10
push esi
lea eax, [ebp - 0x208]
push eax
push esi
push 3
push esi
push esi
push esi
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x10199e1
push dword [0x102bd2c]
push 0x10066f4
push 0x14
push dword [ebp - 0x20c]
call fcn.0100d4d1
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x10198f0
cmp dword [0x102bd2c], 0x3e8
jge 0x1019909
inc dword [0x102bd2c]
push dword [0x102bd2c]
push 0x10066f4
push 0x14
push dword [ebp - 0x20c]
call fcn.0100d4d1
add esp, 0x10
push esi
push esi
push esi
push esi
push dword [ebp - 0x20c]
push dword [ebp - 0x208]
call edi
test eax, eax
je 0x10198c6
push dword [ebp - 0x210]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x210]
push 2
push esi
push dword [ebp - 0x20c]
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp edi, esi
jne 0x1019942
inc dword [0x102bd2c]
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x10199e1
cmp dword [ebp - 0x218], esi
je 0x1019a07
push 0x10069c0
push 0x10069d8
lea eax, [ebp - 0x204]
push 0xff
push eax
call fcn.0100d4d1
add esp, 0x10
push esi
lea eax, [ebp - 0x208]
push eax
push esi
push 3
push esi
push esi
push esi
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x10199e1
push dword [ebp - 0x218]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x218]
push 2
push esi
push dword [ebp - 0x20c]
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x208]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x1019a07
jle 0x10199ef
and edi, 0xffff
or edi, 0x80070000
push edi
push dword [ebp - 0x210]
push 0x1006980
push 2
call fcn.01028201
add esp, 0x10
jmp 0x1019a39
push dword [ebp - 0x210]
push 0x1006944
push 5
call fcn.01028201
add esp, 0xc
cmp dword [ebp + 0x14], esi
je 0x1019a34
push esi
push dword [ebp - 0x210]
mov ecx, 0x102bd30
push 8
call fcn.010185c0
mov edi, 0xd2af9
push dword [ebp - 0x20c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.0101672d
leave
ret 0x10