Function at 0x1001f70
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push esi
push edi
mov al, byte [0x10012a8]
mov byte [ebp - 0x10c], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0x10012a8]
mov byte [ebp - 0x21c], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x21b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x220]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1001ff1
jmp 0x1002232
mov dword [ebp - 0x118], 0
jmp 0x100200c
mov ecx, dword [ebp - 0x118]
add ecx, 1
mov dword [ebp - 0x118], ecx
cmp dword [ebp - 0x118], 0xc8
jge 0x1002056
mov edx, dword [ebp - 0x118]
push edx
push str.wextract_cleanup_d
push 0x100d300
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0x100d300
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1002054
jmp 0x1002056
jmp 0x1001ffd
cmp dword [ebp - 0x118], 0xc8
jne 0x100207b
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x100d300], 0
jmp 0x1002232
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x10012f0
lea ecx, [ebp - 0x21c]
push ecx
call fcn.01007d60
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x10020e2
push 0x10012e0
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 4], 0
je 0x1002111
push 0x104
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x100210f
push 0x10012a8
lea eax, [ebp - 0x10c]
push eax
call fcn.01007d60
jmp 0x1002140
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [0x100e6dc]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1002140
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002232
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
push 0x100de84
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esi + eax + 0x50]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x100219c
push 0
push 0x10
push 0
push 0
push 0x4b5
push 0
call fcn.01004e90
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002232
xor ecx, ecx
cmp dword [ebp - 4], 0
sete cl
mov dword [0x100d350], ecx
cmp dword [ebp - 4], 0
je 0x10021bd
mov dword [ebp - 0x228], str.rundll32.exe__sadvpack.dll_DelNodeRunDLL32___s_
jmp 0x10021c7
mov dword [ebp - 0x228], str._s__D:_s
push 0x100de84
lea edx, [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov eax, dword [ebp - 0x114]
push eax
push 1
push 0
push 0x100d300
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov esp, ebp
pop ebp
ret