Function at 0x10071c2
Capabilities:
Copy file
Delete registry value
Persist via app paths registry key
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xf64
mov eax, dword [0x100d0ac]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x28]
push edi
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0xb0c]
mov dword [ebp - 0xf24], ebx
mov dword [ebp - 0xf34], edi
mov dword [ebp - 0xf54], eax
call fcn.0100a525
xor eax, eax
push edi
lea ecx, [ebp - 0xf18]
mov dword [ebp - 0xf30], eax
mov dword [ebp - 0xf1c], eax
mov dword [ebp - 0xf4c], eax
mov dword [ebp - 0xf3c], eax
mov dword [ebp - 0xf28], eax
call fcn.0100a825
lea eax, [ebp - 0xe0f]
push eax
lea eax, [ebp - 0xe13]
push eax
push 0x1001754
push 0x100d0f8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov esi, 0x105
push esi
lea eax, [ebp - 0x630]
push eax
push 0xd2
push ebx
call dword [sym.imp.USER32.dll_LoadStringA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
lea eax, [ebp - 0x10c]
push eax
push 0x10012fc
push 0x10012f0
mov ebx, 0x10012e8
push ebx
call edi
push dword [ebp - 0xf34]
lea eax, [ebp - 0x528]
push esi
push eax
push 0x10012fc
push 0x10018a4
push ebx
call edi
cmp byte [ebp - 0x10c], 0
je 0x1007e57
cmp byte [ebp - 0x528], 0
je 0x1007e57
lea ecx, [ebp - 0xb0c]
call fcn.0100a67c
xor esi, esi
inc esi
xor ebx, ebx
test eax, eax
je 0x100737b
mov dword [ebp - 0xf20], ebx
call fcn.01003eae
test eax, eax
jne 0x10072f2
call fcn.01003e9c
test eax, eax
jne 0x10072f2
mov dword [ebp - 0xf2c], ebx
jmp 0x1007358
lea eax, [ebp - 0xf20]
push eax
push 0x20019
push ebx
push 0x1001b3c
push 0x80000001
mov dword [ebp - 0xf2c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1007350
lea eax, [ebp - 0xf50]
push eax
lea eax, [ebp - 0xf2c]
push eax
push ebx
push ebx
push 0x1001b24
push dword [ebp - 0xf20]
mov dword [ebp - 0xf50], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xf20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xf2c], ebx
jne 0x100737b
push 0x209
lea eax, [ebp - 0x318]
push eax
push 0xea
push dword [ebp - 0xf24]
call dword [sym.imp.USER32.dll_LoadStringA]
push ebx
jmp 0x1007549
push dword [ebp + 0x1c]
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xf44]
push dword [ebp - 0xf34]
push eax
lea eax, [ebp - 0xf48]
push eax
push dword [ebp - 0xf24]
call fcn.010068c7
test eax, eax
je 0x1007e57
lea eax, [ebp - 0xb0c]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 0x738]
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0xf24]
call fcn.01006304
cmp eax, 0xffffffff
mov dword [ebp - 0xf2c], eax
jne 0x10073ef
mov dword [ebp - 0xf1c], esi
jmp 0x1007e61
lea eax, [ebp - 0x528]
push eax
push 0x100d0f8
lea eax, [ebp - 0x318]
push 0x1001974
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x318]
push eax
call fcn.0100a023
test eax, eax
mov edi, 0x10014a8
je 0x100756d
lea eax, [ebp - 0x318]
push eax
mov esi, 0x10012fc
push esi
push 0x10017c4
push edi
call fcn.0100566c
cmp eax, ebx
mov dword [ebp - 0xf28], eax
je 0x100756d
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100756d
lea ecx, [ebp - 0xb0c]
call fcn.0100a69a
test eax, eax
lea eax, [ebp - 0x318]
jne 0x100747e
push 0x209
jmp 0x1007b6b
push eax
push ebx
push 0x10017ac
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x100756d
lea eax, [ebp - 0xf20]
push eax
push dword [ebp - 0xf24]
mov dword [ebp - 0xf20], ebx
call fcn.0100701d
mov esi, eax
cmp esi, ebx
mov edi, 0x3f2
jne 0x1007504
cmp dword [ebp - 0xf20], ebx
je 0x1007504
lea eax, [ebp - 0xf38]
push eax
push dword [ebp - 0xf20]
mov dword [ebp - 0xf38], ebx
push dword [ebp - 0xf28]
call fcn.010070b1
push dword [ebp - 0xf28]
mov esi, eax
call fcn.0100a0a7
cmp esi, ebx
jne 0x10074fc
mov eax, dword [ebp - 0xf38]
mov dword [ebp - 0xf28], eax
jmp 0x1007504
mov dword [ebp - 0xf28], ebx
mov esi, edi
push dword [ebp - 0xf20]
call fcn.0100a0a7
cmp esi, ebx
je 0x100756d
cmp esi, 0xd
push 0x209
lea eax, [ebp - 0x318]
push eax
je 0x1007536
cmp esi, edi
je 0x100752f
push 0xd3
jmp 0x100753b
push 0xef
jmp 0x100753b
push 0xee
push dword [ebp - 0xf24]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x30
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0xf1c], 0x80070005
jmp 0x1007e61
mov esi, dword [ebp - 0xf24]
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 0xf4c]
push dword [ebp + 0x20]
push dword [ebp + 0x18]
push dword [ebp - 0xf2c]
push eax
lea eax, [ebp - 0xf20]
push eax
push esi
call fcn.01006d86
test eax, eax
je 0x1007b94
push 0x41
pop ecx
xor eax, eax
cmp dword [ebp - 0xf20], ebx
lea edi, [ebp - 0x420]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x420]
push esi
push eax
je 0x10075d1
call fcn.01003879
test eax, eax
jne 0x10075e3
jmp 0x1007e57
call fcn.01004aff
cmp byte [ebp - 0x420], 0
je 0x1007e57
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x528]
push eax
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xa50]
push 0x1001b14
push eax
call edi
add esp, 0x14
push dword [ebp + 0x1c]
lea eax, [ebp - 0x738]
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0xa50]
push eax
push esi
call fcn.01006e99
test eax, eax
je 0x1007b94
cmp dword [ebp - 0xf44], ebx
je 0x1007649
push 0x100d0f8
push esi
call fcn.01008d60
cmp dword [ebp - 0xf2c], ebx
je 0x1007676
cmp byte [ebp - 0x738], 0
je 0x100769c
lea eax, [ebp - 0x738]
push eax
call fcn.01003b9b
push ebx
lea eax, [ebp - 0x738]
push eax
push esi
call fcn.01009300
jmp 0x100769c
push dword [ebp + 0x1c]
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0xf20]
push esi
call fcn.0100611a
cmp eax, 0xffffffff
je 0x1007b94
cmp dword [ebp - 0xf20], ebx
je 0x10076ba
mov dword [ebp - 0xf38], 0x80000002
mov dword [ebp - 0xf2c], 0x10012a8
jmp 0x10076ce
mov dword [ebp - 0xf38], 0x80000001
mov dword [ebp - 0xf2c], 0x1001860
cmp byte [ebp - 0x420], 0
je 0x1007e29
lea eax, [ebp - 0x420]
push eax
call fcn.0100a706
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x318]
push 0x1001b0c
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x318]
push eax
call fcn.0100a706
lea ecx, [ebp - 0xb0c]
call fcn.0100a62b
test eax, eax
mov edi, 0x209
je 0x100774f
push edi
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xf40]
push eax
push dword [ebp - 0xf2c]
push dword [ebp - 0xf38]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x1007772
push edi
jmp 0x1007e2e
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov dword [ebp - 0xf50], eax
lea eax, [ebp - 0x420]
push eax
push 1
push ebx
push 0x1001834
push dword [ebp - 0xf40]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10077e0
push edi
lea eax, [ebp - 0x318]
push eax
push 0xd3
push esi
call dword [sym.imp.USER32.dll_LoadStringA]
push ebx
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0xf40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1007e57
push dword [ebp - 0xf40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xf20], ebx
push dword [ebp + 0x1c]
lea eax, [ebp - 0x630]
push eax
je 0x10078fc
push 0x1001924
push dword [ebp - 0xf34]
call fcn.0100ac25
mov esi, 0xbc2
cmp eax, esi
jne 0x1007825
mov dword [ebp - 0xf30], 1
push dword [ebp + 0x1c]
lea eax, [ebp - 0x630]
push eax
push 0x1001afc
push dword [ebp - 0xf34]
call fcn.0100ac25
cmp eax, esi
jne 0x100784d
mov dword [ebp - 0xf30], 1
cmp dword [ebp - 0xf48], ebx
je 0x1007a5b
push 0x100d0f8
lea eax, [ebp - 0x318]
push 0x1001af0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x318]
push eax
push 0x100d0f8
call fcn.0100af15
test eax, eax
jl 0x1007a5b
lea ecx, [ebp - 0xb0c]
call fcn.0100a6b8
test eax, eax
je 0x1007981
call fcn.0100682c
lea eax, [ebp - 0x318]
push eax
call fcn.01005db6
cmp eax, ebx
mov dword [ebp - 0xf44], eax
jge 0x1007a49
cmp dword [ebp + 0x1c], ebx
jne 0x1007a49
push edi
lea eax, [ebp - 0x318]
push eax
push 0xec
push dword [ebp - 0xf24]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x30
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1007a49
push 0x1001ad4
push dword [ebp - 0xf34]
call fcn.0100ac25
mov esi, 0xbc2
cmp eax, esi
jne 0x100791f
mov dword [ebp - 0xf30], 1
push dword [ebp + 0x1c]
lea eax, [ebp - 0x630]
push eax
push 0x1001ac4
push dword [ebp - 0xf34]
call fcn.0100ac25
cmp eax, esi
jne 0x1007947
mov dword [ebp - 0xf30], 1
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.01005a07
test eax, eax
jne 0x100784d
push edi
lea eax, [ebp - 0x318]
push eax
push 0xd3
push dword [ebp - 0xf24]
jmp 0x1007e3b
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x947]
mov byte [ebp - 0x948], 0
rep stosd dword es:[edi], eax
push 0x41
pop ecx
lea edi, [ebp - 0x83f]
mov byte [ebp - 0x840], al
rep stosd dword es:[edi], eax
mov dword [ebp - 0xf64], 0x1001ab8
mov dword [ebp - 0xf60], 0x1001aac
mov dword [ebp - 0xf5c], 0x1001aa0
mov dword [ebp - 0xf58], 0x1001a94
xor edi, edi
mov esi, 0x1001754
mov ebx, dword [ebp + edi*4 - 0xf64]
push ebx
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x840]
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push ebx
push 0x100d0f8
lea eax, [ebp - 0x948]
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
push 0
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x948]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
inc edi
cmp edi, 4
jb 0x10079d5
lea eax, [ebp - 0x840]
push eax
push dword [ebp - 0xf24]
call fcn.01005cec
mov dword [ebp - 0xf44], eax
xor ebx, ebx
mov edi, 0x209
mov esi, 0xbc2
cmp dword [ebp - 0xf44], esi
jne 0x1007a5b
mov dword [ebp - 0xf30], 1
push dword [ebp - 0xf20]
lea eax, [ebp - 0xf3c]
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.010036ac
test eax, eax
je 0x1007a95
lea eax, [ebp - 0xa50]
push eax
push dword [ebp - 0xf3c]
lea eax, [ebp - 0x10c]
push eax
call fcn.01005309
test eax, eax
jne 0x1007aa8
lea ecx, [ebp - 0xb0c]
call fcn.0100a67c
test eax, eax
jne 0x1007e57
lea ecx, [ebp - 0xb0c]
call fcn.0100a62b
test eax, eax
jne 0x1007b0b
lea ecx, [ebp - 0xb0c]
call fcn.0100a649
test eax, eax
jne 0x1007b0b
mov eax, dword [ebp - 0xf20]
neg eax
sbb eax, eax
and eax, 9
add eax, 0x10
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0xf24]
call fcn.01005227
cmp dword [ebp - 0xf4c], ebx
je 0x1007b38
push dword [ebp - 0xf20]
lea eax, [ebp - 0x10c]
push dword [ebp - 0xf3c]
push eax
call fcn.01004714
jmp 0x1007b38
cmp dword [ebp + 0x14], ebx
jne 0x1007b38
push dword [ebp + 0x1c]
lea eax, [ebp - 0x630]
push eax
push 0x1001a84
push dword [ebp - 0xf34]
call fcn.0100ac25
cmp eax, esi
jne 0x1007b38
mov dword [ebp - 0xf30], 1
cmp dword [ebp + 0x24], ebx
je 0x1007b49
lea eax, [ebp - 0x10c]
push eax
call fcn.01007165
cmp dword [ebp - 0xf28], ebx
je 0x1007cb2
lea ecx, [ebp - 0xb0c]
call fcn.0100a69a
test eax, eax
jne 0x1007ba3
push edi
lea eax, [ebp - 0x318]
push eax
push 0xf0
push dword [ebp - 0xf24]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x10
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0xf1c], 1
jmp 0x1007e61
lea eax, [ebp - 0xf48]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0xf1c], 0x80004005
call fcn.010040fb
test eax, eax
je 0x1007e61
push dword [ebp - 0xf28]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x100
jg 0x1007e61
mov edi, 0x21c
push edi
call fcn.0100a087
mov esi, eax
cmp esi, ebx
jne 0x1007bfd
mov dword [ebp - 0xf1c], 0x8007000e
jmp 0x1007e61
push dword [ebp - 0xf28]
mov dword [esi], edi
mov dword [esi + 4], 0x10
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp - 0xf28]
lea eax, [esi + 0x109]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
push esi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0xf3c]
call dword [ebp - 0xf48]
test eax, eax
push esi
je 0x1007c4b
call fcn.0100a0a7
jmp 0x1007e61
call fcn.0100a0a7
lea eax, [ebp - 0x528]
push eax
push 0x100d0f8
lea eax, [ebp - 0x318]
push 0x1001974
push eax
mov dword [ebp - 0xf1c], ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x318]
push eax
call fcn.0100a023
test eax, eax
je 0x1007cb2
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x318]
push eax
push ebx
push 0x10017c4
mov edi, 0x10014a8
push edi
call esi
lea eax, [ebp - 0x318]
push eax
push ebx
push 0x10017ac
push edi
call esi
cmp dword [ebp - 0xf20], ebx
mov eax, 0x1001a78
jne 0x1007cc4
mov eax, 0x1001a64
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x630]
push ecx
push eax
push dword [ebp - 0xf34]
call fcn.0100ac25
cmp eax, 0xbc2
jne 0x1007ceb
mov dword [ebp - 0xf30], 1
lea eax, [ebp - 0xf40]
push eax
push 0xf003f
push ebx
push dword [ebp - 0xf2c]
push dword [ebp - 0xf38]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1007d2b
push 0x1001834
push dword [ebp - 0xf40]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0xf40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.01003ebd
lea ecx, [ebp - 0xb0c]
call fcn.0100a5ef
test eax, eax
je 0x1007d54
push 0x1001a58
push 0x1001a50
push 0x1001a40
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
cmp dword [ebp - 0xf30], ebx
je 0x1007dc2
push 0x209
lea eax, [ebp - 0x318]
push eax
push 0xdc
push dword [ebp - 0xf24]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x400
push 0x10034
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxExA]
cmp eax, 6
jne 0x1007e61
lea ecx, [ebp - 0xb0c]
call fcn.0100a69a
neg eax
sbb eax, eax
and eax, 0x40002
push eax
push 2
call fcn.01005730
jmp 0x1007e61
cmp dword [ebp + 0x1c], ebx
jne 0x1007e61
lea ecx, [ebp - 0xb0c]
call fcn.0100a67c
test eax, eax
je 0x1007de5
mov ecx, dword [ebp - 0xf54]
call fcn.0100915e
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x318]
push 0x1001918
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push dword [ebp - 0xf20]
lea eax, [ebp - 0x10c]
push dword [ebp - 0xf3c]
push eax
lea eax, [ebp - 0x318]
push eax
call fcn.01004b7e
jmp 0x1007e61
push 0x209
lea eax, [ebp - 0x318]
push eax
push 0xd3
push esi
call dword [sym.imp.USER32.dll_LoadStringA]
push ebx
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0xf1c], 0x80004005
push dword [ebp - 0xf28]
call fcn.0100a0a7
push dword [ebp - 0xf3c]
call fcn.0100a0a7
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xf1c]
pop edi
pop esi
pop ebx
call fcn.01009b9d
leave
ret 0x24