Function at 0x10026950
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x1004c024]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov dword [ebp - 0x330], ecx
mov eax, dword [ebp - 0x330]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x330]
mov eax, dword [edx + 0x10]
call eax
test eax, eax
jne 0x1002698c
mov eax, 1
jmp 0x10026c5d
push 0x1003f4f0
mov ecx, dword [ebp - 0x330]
call fcn.100268a0
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
push 0x1003f4f8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100269e9
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x1003f5a8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x100269e9
xor eax, eax
jmp 0x10026c5d
mov ecx, 0x16
mov esi, str.Microsoft_Software_Shadow_Copy_provider_1.0
lea edi, [ebp - 0x310]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
shl eax, 1
push eax
lea ecx, [ebp - 0x310]
push ecx
push 1
push 0x1003f6b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x5c], 1
push 4
lea edx, [ebp - 0x5c]
push edx
push 4
push 0
push 0x1003f760
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10026a50
jmp 0x10026c2a
mov ecx, dword [str.1.0.0.7]
mov dword [ebp - 0x320], ecx
mov edx, dword [0x1003f770]
mov dword [ebp - 0x31c], edx
mov eax, dword [0x1003f774]
mov dword [ebp - 0x318], eax
mov ecx, dword [0x1003f778]
mov dword [ebp - 0x314], ecx
lea edx, [ebp - 0x320]
push edx
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
shl eax, 1
push eax
lea eax, [ebp - 0x320]
push eax
push 1
push 0
push str.Version
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10026ab5
jmp 0x10026c2a
mov ecx, 0x13
mov esi, 0x1003f7a0
lea edi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
shl eax, 1
push eax
lea eax, [ebp - 0x58]
push eax
push 1
push 0
push 0x1003f78c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10026af6
jmp 0x10026c2a
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [ebp - 0x2b8], 0
push 0x206
push 0
lea eax, [ebp - 0x2b6]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x1003f7f0
push 0x1003f8a0
lea ecx, [ebp - 0x2b8]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x2b8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10026ba2
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x2b8]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x10026ba2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x324], esp
push 0x1003f8b4
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov dword [ebp - 0x334], eax
mov ecx, dword [ebp - 0x330]
call fcn.10025c30
xor eax, eax
jmp 0x10026c5d
mov ecx, 0x13
mov esi, str.65EE1DBA_8FF4_4a58_AC1C_3470EE2F376A
lea edi, [ebp - 0xb0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
shl eax, 1
push eax
lea ecx, [ebp - 0xb0]
push ecx
push 1
lea edx, [ebp - 0x2b8]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
test eax, eax
je 0x10026bea
jmp 0x10026c2a
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x328], esp
push 0x1003f918
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov dword [ebp - 0x338], eax
mov ecx, dword [ebp - 0x330]
call fcn.10025c30
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x10026c5d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x32c], esp
push 0x1003f920
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov dword [ebp - 0x33c], eax
mov ecx, dword [ebp - 0x330]
call fcn.10025c30
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000f6c2
mov esp, ebp
pop ebp
ret