Function at 0x102a775
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push dword [0x104453c]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
push dword [ebp + 0xc]
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
push edi
call esi
add esp, 0x10
xor ebx, ebx
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102aa14
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x1044540]
push edi
call esi
pop ecx
pop ecx
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102aa14
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x1044544]
push edi
call esi
pop ecx
pop ecx
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102aa14
push 0xe73
lea ecx, [ebp - 4]
call fcn.01023477
push dword [eax]
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea ecx, [ebp - 4]
call sub.MFC42u.dll_CString::CString
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x102aa14
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x104453c]
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
push dword [ebp + 0xc]
push edi
call esi
push dword [0x1044540]
push edi
call esi
push dword [0x1044544]
push edi
call esi
push dword [0x1044548]
push edi
call esi
add esp, 0x28
push ebx
lea eax, [ebp + 8]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102aa14
mov eax, dword [ebp + 0xc]
cmp word [eax], 0x2a
jne 0x102a8f2
push dword [0x1044574]
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
push 0x1007a80
push edi
call esi
add esp, 0x10
jmp 0x102a9bf
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push dword [0x1044570]
mov word [edi], bx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102a95e
push 0x20a
push ebx
push edi
mov dword [ebp - 8], 0x208
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
push ebx
push 0x1007a74
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102a952
cmp dword [ebp + 0xc], 1
je 0x102a955
cmp dword [ebp + 0xc], 2
je 0x102a955
mov word [edi], bx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [edi], bx
jne 0x102a971
push 0x1005b3c
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push dword [0x1044574]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
shl eax, 1
push eax
push edi
push dword [0x1044574]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [edi + eax*2]
push eax
call dword [sym.imp.msvcrt.dll_memmove]
push dword [0x1044574]
call dword [sym.imp.msvcrt.dll_wcslen]
shl eax, 1
push eax
push dword [0x1044574]
push edi
call sub.msvcrt.dll_memcpy
push 0x1007a68
push edi
call esi
add esp, 0x24
push ebx
lea eax, [ebp - 0x4c]
push eax
push edi
push 0x1005a0c
call fcn.010364de
test al, al
je 0x102aa0b
mov esi, dword [ebp - 0x48]
push esi
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0xc
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push 4
call dword [fcn.010011a8]
push eax
call dword [fcn.010011a0]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 8