Function at 0x10002450
Capabilities:
Persist via run registry key
Query or enumerate registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x358
mov eax, dword [0x1001cc50]
xor eax, esp
mov dword [esp + 0x354], eax
movdqu xmm0, xmmword [0x10014908]
mov eax, dword [0x10014930]
mov dword [esp + 0x30], eax
mov ax, word [0x10014934]
movdqu xmmword [esp + 8], xmm0
push esi
movdqu xmm0, xmmword [0x10014918]
mov word [esp + 0x38], ax
mov al, byte [0x10014936]
push edi
mov byte [esp + 0x3e], al
lea eax, [esp + 0x151]
movdqu xmmword [esp + 0x20], xmm0
push 0x207
movq xmm0, qword [0x10014928]
push eax
mov dword [esp + 0x14], 0
movq qword [esp + 0x38], xmm0
mov byte [esp + 0x158], 0x22
call fcn.10003d20
push str.CallingCard.exe_
lea eax, [esp + 0x15c]
push 0x208
push eax
call fcn.10007287
lea ecx, [esp + 0x164]
add esp, 0x14
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002500
sub ecx, edx
lea edi, [ecx + 1]
call fcn.10005d90
test al, al
jne 0x1000257d
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [esp + 0x2d]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100026b4
push edi
lea eax, [esp + 0x154]
push eax
push 1
push 0
push str.LogMeInRescueCallingCard
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x354]
xor ecx, esp
call fcn.10006cd8
mov esp, ebp
pop ebp
ret
push 0x105
lea eax, [esp + 0x4c]
push 0
push eax
call fcn.10006cf0
add esp, 0xc
lea eax, [esp + 0x48]
mov esi, 1
push 0x105
push eax
push 0
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x100026b4
lea eax, [esp + 0x48]
push str._Classes
push eax
call fcn.10007750
add esp, 8
test eax, eax
je 0x100025fd
mov ecx, str._Classes
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100025f0
test dl, dl
je 0x100025ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100025f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100025d0
xor eax, eax
jmp 0x100025f5
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000267f
lea ecx, [esp + 0x48]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002604
sub ecx, edx
cmp ecx, 9
jb 0x1000267f
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x4c]
push 0x105
push eax
call fcn.10007287
add esp, 0xc
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [esp + 0x64]
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1000267f
push edi
lea eax, [esp + 0x154]
push eax
push 1
push 0
push str.LogMeInRescueCallingCard
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x105
lea eax, [esp + 0x4c]
push 0
push eax
call fcn.10006cf0
add esp, 0xc
lea ecx, [esp + 0x48]
mov eax, esi
inc esi
push 0x105
push ecx
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x100025b5
mov ecx, dword [esp + 0x35c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.10006cd8
mov esp, ebp
pop ebp
ret