Function at 0x1000a560
Capabilities:
Delete registry value
Get common file path
Persist via default file association registry key
Persist via run registry key
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x624]
add esp, 0xc
mov dword [ebp - 0x620], 1
mov dword [ebp - 0x624], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x620]
push eax
push 0x10202940
push str..exe
push SysReAllocString
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x1000a5f6
cmp dword [ebp - 0x620], 1
jne 0x1000a5f6
lea eax, [ebp - 0x20c]
push str.exefile
push eax
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x1000a610
push 0x10
push str.exefile
push 1
push 0x10202940
push str..exe
push SysReAllocString
call edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x620], 1
lea eax, [ebp - 0x624]
mov dword [ebp - 0x624], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x620]
push eax
push 0x10202940
push str.exefile_shellopencommand
push SysReAllocString
call ebx
test eax, eax
jne 0x1000a685
cmp dword [ebp - 0x620], 1
jne 0x1000a685
lea eax, [ebp - 0x20c]
push str.__1___
push eax
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x1000a69f
push 0x10
push str.__1___
push 1
push 0x10202940
push str.exefile_shellopencommand
push SysReAllocString
call edi
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
call fcn.10174f40
test eax, eax
jne 0x1000a9ce
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.load
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push 0x10202dbc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.load
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push SysReAllocString
call esi
push 0x10202dbc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push SysReAllocString
call esi
push 0x10202dbc
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push 0x10202dbc
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push SysReAllocString
call esi
push str.DelayRun
push str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
lea ecx, [ebp - 0x414]
mov dword [ebp - 0x620], 1
mov esi, str.Explorer.exe
mov dword [ebp - 0x624], 0x208
mov eax, ecx
add esp, 0xc
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1000a7b1
movzx eax, word [esi + ecx]
test ax, ax
je 0x1000a7b1
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1000a791
jmp 0x1000a7b5
test edx, edx
jne 0x1000a7b8
sub ecx, 2
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x620]
push eax
push str.Shell
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
pop esi
test eax, eax
jne 0x1000a82f
cmp dword [ebp - 0x620], 1
jne 0x1000a82f
lea ecx, [ebp - 0x414]
lea eax, [ebp - 0x20c]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000a826
test dx, dx
je 0x1000a822
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000a826
add eax, 4
add ecx, 4
test dx, dx
jne 0x1000a800
xor eax, eax
jmp 0x1000a82b
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000a871
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x1000a840
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000a840
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push str.Shell
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x61c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x61c]
push eax
push str._suserinit.exe_
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.1000aa70
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x1c
mov dword [ebp - 0x620], 1
lea eax, [ebp - 0x624]
mov dword [ebp - 0x624], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x620]
push eax
push 0x10202940
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
cmp word [ebp - 0x20c], 0
je 0x1000a942
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push eax
push 1
push 0x10202940
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x620], 1
lea eax, [ebp - 0x624]
mov dword [ebp - 0x624], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x620]
push eax
push 0x10202940
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call ebx
cmp word [ebp - 0x20c], 0
je 0x1000a9ce
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 2
push eax
push 1
push 0x10202940
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret